Cyber Incident Victim: South St. Paul water utility
Timeline
Summary
More than 30 community water systems across Minnesota were targeted in a coordinated cyberattack aimed at operational technology, with no ransom detected and water service continuing uninterrupted. Officials in Plymouth, Braham, South St. Paul and other communities reported temporary technology malfunctions, switching to manual backups to maintain supply; Braham’s plant was offline for under two hours while Plymouth used a backup plan overnight. State agencies, including MNIT, the FBI and the Minnesota Bureau of Criminal Apprehension, are investigating the incident.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On Tuesday officials announced that more than thirty community water systems across Minnesota had been targeted in a coordinated cyberattack that began on Sunday and Monday. The attacks focused on operational technology and no ransomware was detected during the incidents. Minnesota IT Services reported that despite the intrusions, water service to residents continued without interruption. The agency declined to name the specific communities involved, citing state law that treats cyberattack reports as nonpublic information.
In Plymouth, public works staff noticed technology malfunctions at some facilities Sunday night and shifted to a manual backup process to keep the systems running, with the director stating there was no hiccup in service to the public. In Braham, the mayor said the water system was taken offline for under two hours on Monday morning after crews isolated the affected equipment, and that service was restored without significant interruption. Officials in several other cities, including those ranging from Maple Plain to South St. Paul, reported experiencing similar technology problems over the same two‑day period. They emphasized that water service continued and that residents did not lose access to water.
State officials warned that water utilities, as critical infrastructure, have long been considered vulnerable to such cyber intrusions, noting that the previous year had seen only nine attacks on critical infrastructure statewide compared to the more than thirty incidents occurring simultaneously. The governor’s 2022 executive order had already mandated annual health‑certified assessments, reporting requirements, and response plans for critical infrastructure entities. In response to the current event, Minnesota is collaborating with local, tribal, and federal partners, while the Minnesota Bureau of Criminal Apprehension and the FBI are investigating the source and nature of the attack. An MNIT assistant commissioner emphasized that addressing cyberattacks on critical infrastructure requires a coordinated whole‑of‑government effort to share intelligence, support affected communities, restore operations safely, and strengthen defenses against future threats.