Coordinated OT Attack Hits 30+ Minnesota Water Systems
30 Minnesota water systems hit in a coordinated OT cyberattack July 26-27, knocking Braham's plant offline and triggering statewide incident response.
Marisol "Fuse" Delgado More than 30 Minnesota community water systems were hit on July 26 and 27 in what the Minnesota IT Services (MNIT) agency is calling a coordinated cyberattack targeting operational technology. MNIT activated statewide cybersecurity incident response capabilities. Braham’s water treatment plant went fully offline. Plymouth, South St. Paul, and Maple Plain have also reported disruption — ranging from plant outages to communications failures and affected automated controls. Braham residents were told to minimize water use.
Reporting via BleepingComputer and The Hacker News.
No threat actor has claimed responsibility. The attack vector is not publicly confirmed. MNIT has not released technical indicators as of this writing.
What to do right now
Segment HMI/SCADA from IT networks. If plant controls share network space with corporate email or remote-access infrastructure, that’s the exposure path. This is the thing that needs to happen before you read the rest of this list.
Audit remote access. Pull VPN and RDP logs for the last 72 hours. Look for unrecognized sessions, off-hours access, or connections from unexpected sources. Default credentials on any internet-exposed device get changed today.
Verify manual failover. If automated controls go dark, can your staff run the plant manually? If you don’t know the answer, that’s your answer. Run a tabletop. This incident is a reasonable prompt — use it.
Report. In Minnesota, MNIT is the point of contact. Federally, CISA handles water sector incidents. If you’ve been hit and haven’t reported, do it — coordinated campaign attribution requires data from more than one site. CISA’s water and wastewater sector resources are at cisa.gov/water-and-wastewater-systems-sector.
Priority call
Thirty-plus systems in a single coordinated sweep suggests target selection based on exposure, not specific intelligence about individual utilities. The selection criteria for being hit was probably “reachable,” not anything specific to Braham or Plymouth. Small and mid-sized water systems with aging SCADA equipment and stretched IT staff represent the bulk of that attack surface. If that description fits your system, act like MNIT’s next call might be to you — because statistically, it could be.
Yesterday, CISA and the Australian Signals Directorate published joint guidance on pre-planning OT isolation before an attack forces the decision mid-incident — directly relevant reading: CISA, ASD Issue Joint OT Isolation Guidance. If you want the field reality behind why that guidance is harder to execute than it looks on paper, Loop covered it here: Why OT Isolation Is Harder Than the Advisory Says.
Found this useful? Share it.
