{"id":"minnesota-water-systems-cyberattack-jul-2026","category":"breach","status":"closed","title":"Cyberattack targets more than 30 Minnesota community water systems","tldr":"Attackers targeted equipment at more than 30 Minnesota water systems on 26–27 July. Some utilities used manual operations. Follow your local utility’s notices; no statewide recovery confirmation was found by 3 November.","summary":"Attackers targeted equipment running more than 30 Minnesota community water systems on 26–27 July 2026. Minnesota confirmed malicious activity involving technology used to remotely monitor and control equipment, including industrial controllers and operators’ computer interfaces. This did not mean every affected community lost water service. Braham briefly requested water conservation and restored its well controls within about 90 minutes, reporting no effect on water quality or safety. Minnesota’s 30 July update said there were no active requests to change drinking-water use, while containment, restoration and investigation continued. Officials had not established that every incident involved the same attacker. As of 3 November, the sources reviewed do not establish complete statewide recovery or a final attribution. No specific software flaw or corresponding patch was identified in Minnesota’s statements.","action":"Check your local water utility’s current notices and follow any water-use or safety instructions. There is no household software update for this incident.","product":"Minnesota community water systems’ monitoring and control equipment","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["minnesota","water","critical-infrastructure","cyberattack","operational-technology"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"State partners coordinate response to cyberattack affecting Minnesota water systems","url":"https://content.govdelivery.com/accounts/MNIT/bulletins/42281a6","by":"Minnesota IT Services","date":"2026-07-28"},{"kind":"advisory","title":"Minnesota continues response to cyber activity affecting community water systems","url":"https://content.govdelivery.com/accounts/MNIT/bulletins/422e230","by":"Minnesota IT Services","date":"2026-07-30"},{"kind":"news","title":"Minnesota IT officials disclose ‘coordinated cyberattack’ at more than 30 local water systems","url":"https://www.investing.com/news/general-news/minnesota-it-officials-disclose-coordinated-cyberattack-at-more-than-30-local-water-systems-4818321","by":"Reuters","date":"2026-07-28"},{"kind":"news","title":"Cyberattack targets Minnesota cities’ water systems","url":"https://www.mprnews.org/story/2026/07/28/30-minnesota-municipal-water-systems-targeted-cyberattack","by":"MPR News","date":"2026-07-28"},{"kind":"news","title":"U.S. investigating if Iran was behind cyberattack on water systems in 7 states, including Minnesota and Michigan","url":"https://www.cbsnews.com/news/us-investigating-iran-cyberattack-minnesota-water-systems/","by":"CBS News","date":"2026-08-01"},{"kind":"news","title":"At least 12 states report cyberattacks on water systems possibly linked to Iran-backed hackers, sources say","url":"https://www.cbsnews.com/news/more-states-water-systems-cyberattacks-iran-backed-hackers/?intcid=CNI-00-10aaa3a","by":"CBS News","date":"2026-08-06"}],"started":"2026-07-26","closed":"2026-08-06","created":"2026-11-03T20:41:00.865Z","updated":"2026-11-03T20:41:00.865Z","cve_notes":[],"timeline":[{"at":"2026-08-06","added":"2026-11-03T20:32:12.437Z","kind":"wider-attacks","text":"CBS News reported water-system attacks in at least 12 states, including Minnesota; investigators suspected Iran-backed hackers but had made no formal attribution.","url":"https://www.cbsnews.com/news/more-states-water-systems-cyberattacks-iran-backed-hackers/?intcid=CNI-00-10aaa3a","by":"CBS News","patch":null},{"at":"2026-07-30","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Minnesota confirmed malicious activity mainly involved remote monitoring and control equipment. It said affected systems had not all experienced water-service disruption, and investigators had not established that every incident had the same perpetrator.","url":"https://content.govdelivery.com/accounts/MNIT/bulletins/422e230","by":"Minnesota IT Services","patch":null},{"at":"2026-07-28","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Plymouth restored normal communications that afternoon after temporarily operating manually, according to a city official quoted by CBS News.","url":"https://www.cbsnews.com/news/us-investigating-iran-cyberattack-minnesota-water-systems/","by":"CBS News","patch":null},{"at":"2026-07-28","added":"2026-11-03T20:32:12.437Z","kind":"disclosed","text":"Minnesota announced its statewide response, involving utilities, public-health agencies and federal investigators. Officials knew of no active requests for residents to change drinking-water use.","url":"https://content.govdelivery.com/accounts/MNIT/bulletins/42281a6","by":"Minnesota IT Services","patch":null},{"at":"2026-07-27","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Braham temporarily asked residents to conserve water after attackers disabled its well controls. Staff restored operation within about 90 minutes; the city reported no effect on water quality or safety.","url":"https://www.mprnews.org/story/2026/07/28/30-minnesota-municipal-water-systems-targeted-cyberattack","by":"MPR News","patch":null},{"at":"2026-07-26","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"A coordinated attack began against equipment running Minnesota community water systems. Minnesota later said more than 30 systems were targeted across 26–27 July.","url":"https://content.govdelivery.com/accounts/MNIT/bulletins/42281a6","by":"Minnesota IT Services","patch":"na"}],"url":"https://hard.fyi/live/minnesota-water-systems-cyberattack-jul-2026/","json":"https://hard.fyi/api/live?id=minnesota-water-systems-cyberattack-jul-2026"}