Cyberattack targets more than 30 Minnesota community water systems
Attackers targeted equipment at more than 30 Minnesota water systems on 26–27 July. Some utilities used manual operations. Follow your local utility’s notices; no statewide recovery confirmation was found by 3 November.
Check your local water utility’s current notices and follow any water-use or safety instructions. There is no household software update for this incident.
What’s happening
Attackers targeted equipment running more than 30 Minnesota community water systems on 26–27 July 2026. Minnesota confirmed malicious activity involving technology used to remotely monitor and control equipment, including industrial controllers and operators’ computer interfaces. This did not mean every affected community lost water service. Braham briefly requested water conservation and restored its well controls within about 90 minutes, reporting no effect on water quality or safety. Minnesota’s 30 July update said there were no active requests to change drinking-water use, while containment, restoration and investigation continued. Officials had not established that every incident involved the same attacker. As of 3 November, the sources reviewed do not establish complete statewide recovery or a final attribution. No specific software flaw or corresponding patch was identified in Minnesota’s statements.
- What
- Breach
- Affects
- Minnesota community water systems’ monitoring and control equipment
- Fixed in
- Nothing to patch
- Since
- 26 July 2026
- Closed
- 6 Aug 2026
Timeline
- Wider attacks
CBS News reported water-system attacks in at least 12 states, including Minnesota; investigators suspected Iran-backed hackers but had made no formal attribution.
- Update
Minnesota confirmed malicious activity mainly involved remote monitoring and control equipment. It said affected systems had not all experienced water-service disruption, and investigators had not established that every incident had the same perpetrator.
- Update
Plymouth restored normal communications that afternoon after temporarily operating manually, according to a city official quoted by CBS News.
- Made public
Minnesota announced its statewide response, involving utilities, public-health agencies and federal investigators. Officials knew of no active requests for residents to change drinking-water use.
- Update
Braham temporarily asked residents to conserve water after attackers disabled its well controls. Staff restored operation within about 90 minutes; the city reported no effect on water quality or safety.
- UpdateNothing to patch
A coordinated attack began against equipment running Minnesota community water systems. Minnesota later said more than 30 systems were targeted across 26–27 July.
Sources
- State partners coordinate response to cyberattack affecting Minnesota water systemsMinnesota IT Services · 28 July 2026
- Minnesota continues response to cyber activity affecting community water systemsMinnesota IT Services · 30 July 2026
- Minnesota IT officials disclose ‘coordinated cyberattack’ at more than 30 local water systemsReuters · 28 July 2026
- Cyberattack targets Minnesota cities’ water systemsMPR News · 28 July 2026
- U.S. investigating if Iran was behind cyberattack on water systems in 7 states, including Minnesota and MichiganCBS News · 1 Aug 2026
- At least 12 states report cyberattacks on water systems possibly linked to Iran-backed hackers, sources sayCBS News · 6 Aug 2026