Cyber Incident Victim: City of Plymouth

Overnight Sunday, Plymouth announced that two of its water towers and multiple lift stations were impacted by what it believes to be a cyberattack. The city issued a statement confirming the suspected cyberattack on its water infrastructure. Plymouth stated that the attack did not affect water safety or plant operations. Earlier the same day, the neighboring city of Braham reported that its water plant was taken offline due to a malicious cyber‑attack on computerized operating systems. Braham’s water plant shutdown halted well and plant operations, prompting the city to rely on its water tower to supply residents. Braham asked residents to conserve water until the issue was resolved. After a few hours, Braham’s water plant was restored and normal water use resumed. Both Plymouth and Braham emphasized that the cyber incident did not compromise the safety of the water supply. The attacks occurred within a short time frame, suggesting a coordinated effort across multiple municipalities. State officials were notified and began monitoring the situation.

In response to the incidents, Minnesota IT Services (MNIT) issued a statement indicating it is providing cybersecurity and technical support to state and local partners. MNIT teams are assisting with assessing potential cyber impacts, sharing threat information, and supporting response and remediation efforts. The agency highlighted its established capabilities for preparing for, responding to, and recovering from cyber incidents affecting government systems. MNIT said it will continue working with partners to assess the situation, support affected communities, and share confirmed information as it becomes available. The state of Minnesota confirmed it is aware of the attacks and is helping impacted communities while the source of the cyber activity remains under investigation. Plymouth’s city officials have been coordinating with MNIT and other agencies to gather details about the scope of the intrusion. The city of Braham’s administrator has requested that its vulnerability study be reevaluated to identify any weaknesses that may have been exploited. This reevaluation is intended to inform future hardening of critical infrastructure against similar threats. No specific details about the attackers, their motives, or the exact malware used have been disclosed in the public statements. The ongoing investigation aims to determine whether additional municipalities beyond Plymouth and Braham were targeted.

The cyberattack disrupted the normal operation of Plymouth’s two water towers and multiple lift stations, though water pressure and quality remained within safe limits. Braham’s reliance on its water tower allowed continued service to residents while the plant was offline, and the conservation request was lifted once systems were restored. Both cities reported that essential water delivery functions were maintained throughout the incident, preventing any loss of service or health risk. The incidents have prompted a broader review of cybersecurity posture among Minnesota municipalities that operate water and wastewater facilities. Officials have indicated that lessons learned from the event will be shared with other jurisdictions to improve detection and response capabilities. As of the latest public updates, the investigation is ongoing and no arrests or attributions have been made. The coordinated response involving city staff, state agencies, and MNIT exemplifies the established protocol for handling cyber threats to critical infrastructure. Residents in both Plymouth and Braham have been advised to resume normal water use following the restoration of affected systems. The situation underscores the importance of continuous monitoring and timely incident reporting for essential services. No further technical details about the attack vector or mitigation steps have been released beyond the confirmed impact on water towers and lift stations.