Coordinated Cyberattack Disrupts Water Utilities in Minnesota

urldefense.com

Coordinated Cyberattack Disrupts Water Utilities in Minnesota

First seen 28 Jul 2026, 01:48 UTC • •77.0

Article Content

1 / 326

Browse articles

ThreatCluster •July 29, 2026 at 01:14 UTC

•Over 30 Minnesota communities experienced disruptions to water utilities due to a cyberattack.
•The attack targeted computerized operating systems, causing temporary outages but no water quality issues.
•State and federal agencies are investigating the incident, with indications of potential Iranian involvement.

A coordinated cyberattack affected water utilities in over 30 Minnesota communities on July 26 and 27, 2026. Key cities impacted include Plymouth, South St. Paul, Braham, and Maple Plain. The attack targeted computerized operating systems, causing temporary outages but no compromise to water quality. Officials reported that the attacks were executed by unknown actors, with speculation pointing towards Iranian hacking groups. Minnesota's IT Services activated its cybersecurity response capabilities, collaborating with federal agencies like CISA and the FBI. While the immediate threat was contained, investigations into the attack's origin are ongoing. Residents were assured that drinking water remained safe throughout the incident.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 89d ago How this analysis works

Timeline

2026-07-26

Cyberattack begins targeting Minnesota water systems

A coordinated cyberattack affects water utilities in multiple communities, including Plymouth and Braham.

2026-07-27

Multiple cities report cyberattacks

Cities including Plymouth, South St. Paul, and Maple Plain confirm cyberattacks impacting their water facilities.

2026-07-27

Braham water plant outage confirmed

Braham officials report a brief outage at their water plant due to a cyberattack, which was quickly resolved.

2026-07-28

State officials confirm over 30 communities affected

Minnesota IT Services announces that more than 30 communities experienced disruptions due to the cyberattack.

More articles in this cluster (325)

Threat Graph

11 entities, 11 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Malware
T1021 - Remote Services

Organization (7)

Braham
City Of Braham
FBI
Maple Plain
Minnesota IT Services
Plymouth
South St. Paul

Affected Platform (2)

MicroLogix 1100
MicroLogix 1400

Relationships

Malware targets MicroLogix 1100
Malware targets MicroLogix 1400
T1021 - Remote Services targets MicroLogix 1100
T1021 - Remote Services targets MicroLogix 1400
Malware related to Braham
Malware related to City Of Braham
Malware related to FBI
Malware related to Maple Plain
Malware related to Minnesota IT Services
Malware related to Plymouth
Malware related to South St. Paul

Following this threat?

Track Braham in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…

Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…