Cyber Incident Victim: Braham
Timeline
Summary
A coordinated cyberattack targeted operational technology systems at dozens of Minnesota water utilities, including Braham, Maple Plain, South St. Paul, and Plymouth, disrupting automated control functions. Braham temporarily took its water plant offline after attackers shut down its well and treatment controls, while Plymouth reported the impact limited to equipment linked via cellular communications. Officials said drinking water remained safe and services stayed operational, and investigators have not attributed the incident to any specific actor despite noting similarities to Iran‑linked threat groups. Experts highlighted that the attack underscores risks to cellular‑connected SCADA components and the need to reassess vulnerability studies.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On July 26 and 27 2026 a coordinated cyberattack struck operational technology systems at dozens of community water utilities across Minnesota, with more than thirty systems reported as targeted. The City of Braham detected the intrusion and promptly took its water plant offline, issuing a public notice urging residents to minimize water use while the incident was investigated. Braham officials stated that the attackers had shut down the operating controls, which in turn halted the well and the water treatment plant’s processes. Despite the shutdown, contingency procedures were activated and the city maintained that drinking water remained safe and that essential water and wastewater services continued to operate. In a majority of the affected utilities, officials reported that automated control functions were impacted but that core operations stayed functional through manual or backup measures. The City of Plymouth noted that the disruption was limited to equipment linked via cellular communications within its SCADA system, highlighting a specific vector of interference.
State and federal agencies launched an investigation into the attacks, and officials confirmed that no formal attribution had been made at the time of reporting. The incidents followed a recent US government warning about Iran-linked threats targeting industrial control systems from vendors such as Siemens, Rockwell Automation, and Schneider Electric. Affected cities, including Braham, Maple Plain, South St. Paul, and Plymouth, communicated to the public that their water supplies were safe and that service disruptions were being managed through existing response plans. Investigators continued to examine the commonalities across the incidents, focusing on the methods used to compromise operational technology and the potential implications for similar infrastructure elsewhere. The narrative of the event remains centered on the timeline of detection, the immediate operational impacts on Braham’s water facility, the activation of contingency measures, and the ongoing efforts to understand the scope and origin of the attack.