Over 30 Minnesota Water Utilities Disrupted in Coordinated Weekend Cyberattack

The Attack and Local Impact

Over the weekend of July 26 and July 27, 2026, a coordinated cyberattack struck deep into local infrastructure, hitting operational technology across more than 30 municipal water and wastewater utilities in Minnesota. The intrusions scrambled computerized controls and cellular modems tied to water towers and lift stations, shaking up towns like Braham, Plymouth, South St. Paul, and Maple Plain. The situation got tense in Braham when attackers managed to lock out operating controls entirely, forcing the local treatment plant offline for about two hours. Plant crews jumped into action and brought systems back online using manual overrides, while other towns pulled their cellular modems offline to contain the damage and keep clean tap water flowing.

The Response and Federal Push

By July 28, 2026, Minnesota IT Services intervened, sending out incident response teams around the state to assist small-town operators with network cleanup, threat isolation, and vulnerability patching. Residents were promptly informed by state officials that boil water warnings were not necessary and that drinking water was fully safe. In order to determine how the attackers gained access and whether this was a part of a wider, coordinated assault against vital infrastructure throughout the nation, MinnesotaIT Services are now collaborating with the FBI, the EPA, and the Cybersecurity and Infrastructure Security Agency.

Author Notes

Minnesota IT Services (MNIT), “MNIT activates statewide cybersecurity response to support affected communities and protect critical infrastructure,” Official Press Release, July 28, 2026.

About the Author

Carmen Estela is a Cybersecurity Research Analyst at Cyber Defense Magazine and a Women in Cybersecurity Award Candidate. She recently graduated with a Master of Science degree from the University of Central Florida and holds a Bachelor’s degree in Criminology from the University of Florida with certifications in Data Analytics and AI Fundamentals. She frequently speaks and volunteers at well-known industry gatherings, such as BSides Orlando and BSides Jax, where she offers her perspectives on emerging cyber trends. Carmen is committed to advancing the standards of governance, risk, and compliance within cybersecurity. She has also served as an adult protective investigator, police dispatcher, and legal intern, applying investigative skills across law enforcement, academic, and public service settings. 

Reach her online at [email protected].