Cyber Incident Victim: City of Maple Plain
Date:
Jul 2026
Location:
United States of America
Summary
A cyberattack targeted water utility systems in several Minnesota communities, briefly disabling the Braham water plant and affecting automated controls in South St. Paul, Plymouth, and the City of Maple Plain. Officials reported that the intrusion disrupted computerized operating systems but did not compromise water quality or safety, and local public works crews maintained normal operations through manual procedures. State cybersecurity teams are providing technical assistance, assessing impacts, and sharing threat information while the investigation continues.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 0 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On Monday morning, the City of Braham posted on Facebook at 9:34 a.m. that its water plant was offline for an unknown reason. Just under two hours later, officials announced that the facility was back online and attributed the outage to a malicious cyber‑attack of computerized operating systems by unknown actors. The attack shut down the plant’s operating controls, which halted the well and water treatment processes. Braham officials said the incident did not cause any physical damage to the facility and did not affect water quality or safety. Shortly after the Braham announcement, the city reported that at least four other Minnesota communities had experienced similar attacks with the same result. Officials in South St. Paul said they identified a cybersecurity incident involving technology used for parts of the city’s water utility system on Monday afternoon. Plymouth officials noted that an issue affecting communications at two water towers and multiple lift stations began late Sunday and was believed to be caused by a cyberattack. Maple Plain officials said they identified a cybersecurity incident involving the city’s water utility technology early on Monday.
In Braham, the shutdown of operating controls stopped the well and water treatment plant, but crews were able to restore service without any physical harm to the infrastructure. South St. Paul officials said the incident impacted some automated control functions, yet Public Works staff were able to maintain normal water and wastewater operations through interim measures. Plymouth officials explained that the problem was limited to equipment connected via cellular communications, leaving water levels and quality unaffected and allowing crews to continue normal operations using manual procedures. Maple Plain officials reported that the incident affected certain automated control functions, but city workers kept normal operations running.
Braham’s public works crews quickly determined the cause of the outage and mediated the issue to bring the plant back online. Minnesota IT Services stated it was providing cybersecurity and technical support to local workers responding to the attack. The agency’s teams were assessing potential cyber impacts, sharing threat information, and supporting response and remediation efforts. Officials said they were working closely with partners to protect critical systems while the investigation continued. Across the affected communities, staff relied on manual procedures and existing operational procedures to keep water and wastewater services functioning normally throughout the incident.