Cyber Incident Victim: City of Braham
Timeline
Summary
A cyberattack disabled the computerized operating systems at the water plant in Braham, taking the facility offline and prompting the city to rely on its water tower while asking residents to conserve use until service was restored. Plymouth reported similar disruptions to two water towers and several lift stations, though officials said water safety was not compromised. Minnesota IT Services is providing cybersecurity and technical assistance to the affected communities as investigators work to identify the source. The city’s administrator has called for a reassessment of the vulnerability study to address any weaknesses exposed by the incident.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 0 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On July 27, 2026, the city of Braham announced that its water plant was offline for an unknown reason. A few hours later, the city confirmed that the system was back online and that the outage was not a random failure. Crews identified that the water plant outage resulted from a malicious cyber‑attack on the computerized operating systems by unknown actors. The attack disabled the operating controls at the plant, causing the well and the treatment facility to go offline. While the plant was down, Braham relied on the water stored in its water tower to continue supplying residents. The city issued a request for residents to conserve water until the issue was resolved. Once the plant was restored, the conservation request was lifted and normal water use resumed.
Around the same time, the neighboring city of Plymouth reported that two of its water towers and multiple lift stations were also affected by what it believes to be a cyber‑attack that began overnight Sunday. Plymouth officials stated that the attack did not compromise water safety or plant safety, mirroring Braham’s assessment. Both communities indicated that the incident appears to be part of a broader campaign targeting other municipalities, and they noted that the state of Minnesota is aware of the situation and is providing assistance while the source of the attack remains under investigation. Minnesota IT Services (MNIT) issued a statement confirming that it is delivering cybersecurity and technical support to state and local partners responding to the incident, including assessing potential cyber impacts, sharing threat information, and supporting response and remediation efforts.
MNIT emphasized that addressing cybersecurity incidents requires a coordinated, methodical response and highlighted Minnesota’s established capabilities and partnerships that help governments prepare for, respond to, and recover from such events. The agency said it would continue working with its partners to assess the situation, support affected communities, and share confirmed information as it becomes available. In response to the Braham incident, the city administrator announced a request to have Braham’s existing vulnerability study reevaluated to identify any weaknesses that may have been exposed or created by the attack. With the plant back online and the conservation advisory lifted, Braham residents have returned to normal water consumption while the investigation continues.