Cyber Incident Victim: Plymouth water utility
Timeline
Summary
More than 30 community water systems across Minnesota were targeted in a coordinated cyberattack that focused on operational technology, with no ransom detected and water service maintained. Plymouth water utility officials observed technology malfunctions and activated backup manual controls to keep water quality and quantity unaffected. In Braham the system was briefly isolated and restored within a few hours, while other communities reported similar equipment issues. State agencies, including Minnesota IT Services, the Bureau of Criminal Apprehension and the FBI, are investigating the incident and working with local and federal partners to strengthen defenses.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 0 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On July 28, 2026, Minnesota officials announced that more than 30 community water systems across the state had been targeted in a coordinated cyberattack that began on Sunday and Monday. The attacks focused on operational technology components of the water utilities, according to Minnesota IT Services (MNIT). No ransomware demands were detected during the incidents, and water service to residents continued uninterrupted. MNIT characterized the activity as a statewide cybersecurity event affecting critical infrastructure. The agency noted that while the attacks caused technology malfunctions, they did not result in a loss of water supply.
In Plymouth, city officials began observing technology malfunctions at some water facilities on Sunday night and promptly switched to a backup plan to operate those systems manually. Plymouth’s public works director, Michael Thompson, stated that there was no disruption to public water service and that the city’s checks and controls allowed manual operation to maintain water quality and quantity. A Plymouth resident, Kiley Gay, reported noticing no changes in her water supply during the incident. Nearby Braham experienced a short outage, with Mayor Nate George saying the water system was offline for under two hours on Monday morning after crews isolated it, after which service was restored without significant interruption. Other communities ranging from Maple Plain to South St. Paul reported similar technology issues over the same two‑day period.
The state response involved coordination with local, tribal, and federal partners, including the Minnesota Bureau of Criminal Apprehension and the FBI, to investigate the source and scope of the attacks. MNIT assistant commissioner and Minnesota chief information security officer John Israel emphasized that cyberattacks against critical infrastructure require a whole‑of‑government response and that the agency was sharing intelligence, supporting affected communities, and helping utilities restore operations safely while strengthening defenses. Officials highlighted that water systems are classified as critical infrastructure, noting that MNIT’s annual report recorded only nine cyberattacks on such sectors during the entire previous year, whereas the current incident affected more than thirty systems simultaneously. The heightened attention follows Governor Tim Walz’s 2022 executive order that declared critical infrastructure to be facing increasingly sophisticated cyberattacks and mandated annual health‑department‑certified assessments, reporting requirements, and response plans for utilities.