Cyber Incident Victim: City of Plymouth
Date:
Jul 2026
Location:
United States of America
Summary
A cyberattack disrupted computerized operating systems at the Braham water plant, shutting it down briefly before crews restored service and reported that at least four other Minnesota communities experienced similar intrusions. In Plymouth, the incident affected cellular‑linked communications at two water towers and multiple lift stations, but officials said water levels and quality remained safe and operations continued manually. South St. Paul and Maple Plain also reported impacts on automated control functions of their water utilities, though workers maintained normal service using manual procedures, and state IT agencies provided technical support.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Late Sunday, Plymouth officials noticed an issue impacting communications at two of the city's water towers and multiple lift stations. They posted about the issue on Facebook. The post stated that the problem was believed to have been caused by a cyberattack. Officials emphasized that water levels and water quality were unaffected and the water remained safe. They said there was no need for the public to adjust consumption. The issue was limited to equipment connected via cellular communications within the system.
In response, Plymouth public works crews continued to operate the water system through manual procedures. This allowed them to maintain normal water and wastewater operations despite the communications disruption. Minnesota IT Services provided cybersecurity and technical support to local workers responding to the attack. The agency helped assess potential cyber impacts, share threat information, and support response and remediation efforts. They also worked closely with partners to protect critical systems while the investigation continued.
The Plymouth incident was part of a broader series of cyberattacks that affected at least four other Minnesota communities. In Braham, the water plant was briefly shut down due to a malicious cyber-attack of computerized operating systems by unknown actors. The facility was back online within under two hours, with no physical damage or impact on water quality. South St. Paul officials identified a cybersecurity incident involving technology used for parts of the city's water utility system, which impacted some automated controls but allowed normal operations to be maintained. Maple Plain also reported a cybersecurity incident affecting certain automated control functions, yet city workers kept normal operations running. Officials noted that at least four other communities experienced similar results from the same type of attack. An investigation into the source and scope of the attacks remained ongoing.