Cyber Incident Victim: Braham water system

On July 28 2026 Minnesota officials announced a statewide response after more than thirty community water systems across the state were targeted in a coordinated cyberattack. The attacks were first noticed on Sunday night when several cities reported technology malfunctions at their water facilities, and the issue continued into Monday with officials describing the incidents as affecting operational technology. Minnesota IT Services confirmed that the cyber activity focused on operational technology systems, detected no ransomware demand, and noted that water service to residents remained uninterrupted despite the disruptions. In Plymouth, public works staff observed malfunctions at some facilities Sunday night, switched to manual operation of the affected systems, and reported that there was no hiccup in public water service according to Plymouth’s public works director Michael Thompson. Similar technology problems were reported over the past two days in other communities ranging from Maple Plain to South St. Paul, and in Braham Mayor Nate George said the local water system was taken offline for under two hours on Monday morning after crews isolated it, after which service was restored without significant interruption.

Residents in Plymouth said they did not notice any changes during the incident, with one resident, Kiley Gay, stating that she and her family experienced no difference in water availability for bathing or drinking. Officials emphasized that the manual backup plans prevented any loss of water pressure or quality, and that the Braham system was brought back online quickly after the brief isolation. The event was framed within the broader context of water services being classified as critical infrastructure, with MNIT’s annual report showing only nine cyberattacks on such infrastructure during the previous year, compared to the more than thirty incidents reported in this single wave. Governor Tim Walz’s 2022 executive order, which called for annual assessments certified by the Minnesota Department of Health and mandated reporting and response plans, had been highlighted as part of the state’s ongoing focus on protecting critical infrastructure from increasingly sophisticated cyber threats.

In response to the attack, the state said it is collaborating with local, tribal and federal officials to investigate the incident, while law enforcement agencies including the Minnesota Bureau of Criminal Apprehension and the FBI are working to determine what occurred. MNIT assistant commissioner and Minnesota chief information security officer John Israel stated that cyberattacks against critical infrastructure require a coordinated, whole‑of‑government response, and that MNIT is sharing intelligence with partners, supporting affected communities, helping utilities restore operations safely, and working to strengthen defenses against future attacks. The ongoing efforts aim to ensure that water systems remain operational and secure as the investigation continues.