# Thirty-Plus Minnesota Water Systems Hit in Coordinated OT Attack — One Plant Forced Offline
## The Threat
Over the weekend of July 26–27, attackers struck more than 30 community water systems across Minnesota in what state officials are calling a coordinated campaign against operational technology infrastructure. The incidents were not a wave of opportunistic scans — investigators identified shared timing, shared access methods, and a shared target profile across systems in different cities, pointing to deliberate, multi-site execution rather than coincidence.
The consequences were uneven but real. Braham's water treatment plant went offline entirely, forcing the city to ask residents to cut water use until treatment could resume. Plymouth reported cellular communications failures at two water towers and several wastewater lift stations, keeping operations running only by switching to manual control. South St. Paul and Maple Plain saw automated utility controls disrupted; Maple Plain went far enough to declare a local state of emergency to unlock emergency response resources. The fact that most systems kept the water running says more about manual fallback procedures than about the limits of what the attackers attempted.
Officials have been deliberate about what they will and won't say publicly. Minnesota IT Services confirmed the incident count and the coordinated nature of the campaign but declined to identify the attacker, the specific vector of access, or whether any data was exfiltrated — citing an active investigation involving CISA, the EPA, and the FBI. Attribution has not been finalized. What investigators did say: the attack pattern bears similarities to activity federal partners have observed in other states and industries, a statement that carries significant weight given what U.S. agencies had warned just four days earlier.
## Severity and Impact
This incident has not been assigned a CVE — it is an active infrastructure attack, not a disclosed software vulnerability. The table below reflects available threat characterization from MNIT and federal advisories.
| Attribute | Detail |
|---|---|
| CVE | None assigned (active incident, no disclosed CVE) |
| CVSS Score | N/A |
| Attack Type | OT/ICS disruption — water and wastewater systems |
| Access Method | Under investigation; common access method confirmed across sites |
| Operational Impact | Plant outage (Braham), communications failure (Plymouth), automated control disruption (South St. Paul, Maple Plain) |
| Data Exfiltration | Not confirmed publicly |
| Attribution Status | Unfinalized; CyberAv3ngers / IRGC-CEC consistent with observed tradecraft (Tenable) |
| Federal Involvement | CISA, EPA, FBI, MNIT |
| Related Advisory | U.S. agencies warned July 22 of Iranian-affiliated actors targeting PLCs from Rockwell Automation, Schneider Electric, and Siemens |
## Affected Products
Specific products exploited in the Minnesota incident have not been disclosed. The parallel federal advisory from July 22 identified similar OT targeting across:
Programmable Logic Controllers (PLCs)
Systems Observed Being Manipulated in Related Campaign
Minnesota-specific affected infrastructure includes water towers (Plymouth), wastewater lift stations (Plymouth), and water treatment plant controls (Braham). MNIT is not disclosing additional technical specifics during the active investigation.
## Mitigations
With attribution and attack vector still under wraps, defenders cannot patch a specific CVE — but the July 22 federal advisory on Iranian-affiliated PLC targeting offers directly applicable guidance:
Immediate Actions
Network Segmentation
Detection and Monitoring
Reporting
Longer Term
## References
---
## HackWire Analysis
The timing here is not subtle. Four days before the Minnesota attacks landed, U.S. agencies issued an expanded warning about Iranian-affiliated actors probing internet-facing PLCs from the three largest industrial control system vendors on the planet. Then 30 water systems across a single state go down simultaneously over a weekend. MNIT's careful language — "consistent with activity observed by federal partners in other states and industries" — is about as close to a direct signal as an active investigation will produce.
CyberAv3ngers, the group most consistent with this tradecraft according to Tenable, has been a persistent threat against water infrastructure since at least late 2023. Their known playbook involves internet-exposed PLCs, HMI manipulation, and logic tampering — exactly what the July 22 advisory warned about. The IRGC-CEC connection matters because it means this is not opportunistic ransomware. This is a state-affiliated actor testing how far they can reach into critical infrastructure and how much disruption they can cause before a response materializes.
What should concern defenders is not Braham's plant going offline — it's that 30 systems were touched before anyone noticed a pattern. Minnesota's response was reasonably fast once the incidents were reported, but the detection gap between first compromise and coordinated response is where these campaigns do their real damage. Most small community water systems operate with minimal security staffing, aging OT equipment, and internet-exposed controls that haven't been audited in years. They are the long tail of critical infrastructure that national security frameworks were not designed around.
The practical lesson from Plymouth is worth underscoring: manual fallback procedures kept services running when automated controls failed. That is not a legacy limitation — it is a resilience capability. Every water utility should have documented manual procedures and staff trained to execute them before an attack forces the question.
— HackWire Editorial
---
## Related Coverage