Cyber Incident Victim: City of Plymouth
Timeline
Summary
Plymouth experienced a cyber attack that disrupted communication with a third of its water towers and 14 lift stations, prompting staff to monitor the sites in person and temporarily add overnight shifts. The Supervisory Control and Data Acquisition system lost contact with the affected facilities, though water supply and quality remained unchanged. City IT and public safety teams worked with vendors to reset systems and restore connectivity by the following afternoon. Investigators have not identified the perpetrator, but some experts note similarities to an Iran‑backed hacking group that has targeted similar infrastructure elsewhere. State officials are assisting the response, and city officials credit their preparedness for the rapid recovery.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On July 26, 2026, Plymouth Public Works staff observed that one of the city’s water facilities failed to communicate with the Supervisory Control and Data Acquisition (SCADA) system at approximately 7:30 p.m. Sunday. A second facility lost contact at 12:30 a.m. the following morning, prompting Public Works Director Michael Thompson to note the anomaly of multiple simultaneous outages. Investigation revealed that the SCADA system ultimately lost communication with about one‑third of Plymouth’s water towers and less than half of its lift stations, specifically two water towers and fourteen lift stations. These affected sites relied on cellular connections to the SCADA network, while sites linked by fiber or other methods remained uninterrupted.
Because the remote monitoring link was broken, operators had to dispatch additional personnel to each affected tower and lift station to verify equipment status and water levels in person. Normally the department does not schedule overnight shifts, but extra staff were called in to remain on site through Monday night to maintain continuous observation. The public works team coordinated with the city’s IT and public safety divisions and relevant vendors to restore connectivity, perform hard resets on the compromised systems, and confirm that all devices were protected before returning them to service. By Tuesday afternoon the IT department reported that the affected systems were back online and the water supply and quality remained unaffected, describing the incident as a communications outage rather than a contamination event.
Throughout the response, Minnesota state agencies offered assistance to the impacted water systems, and law‑enforcement partners began gathering data to determine how the attackers gained access. Investigators have not identified a perpetrator, but cybersecurity firm Tenable noted similarities to the Iran‑linked group CyberAv3ngers, which had previously targeted the Municipal Water Authority of Aliquippa in 2023. The city’s Public Works Director highlighted that the rapid restoration—achieved in under two days—demonstrated the effectiveness of existing preparedness plans and the ability to maintain safe drinking water for residents during an unprecedented cyber event.