The attack landed over July 26 and 27, when more than 30 community water systems across Minnesota were hit in a coordinated intrusion into the operational technology that runs pumps, wells and treatment controls. Braham, Plymouth, South St. Paul and Maple Plain all confirmed they were targeted. In Braham, unknown malware shut down the controls at its well and water treatment plant, leaving the city's water tower unable to refill for more than an hour, according to the city administrator. Plymouth and South St. Paul switched to manual operation of their systems to keep water flowing.
Officials say drinking water stayed safe throughout, and most utilities kept service running on backup procedures. No formal attribution has been made, but the timing lines up with recent federal warnings about Iranian-linked groups probing industrial control systems in the water sector, and investigators have flagged Iran-affiliated groups as a possible match for the attack's profile.
Jonathan Wrolstad, an instructor in cyber threat intelligence at the University of Minnesota's Technological Leadership Institute, has been walking through what made these systems vulnerable in the first place and what would actually help. He teaches the institute's graduate course on cyber threat intelligence and spent nearly two decades tracking threat actors for firms including Mandiant, Symantec and ExtraHop before moving into teaching.
Plymouth's own account of its intrusion matches that pattern, with officials there saying the breach was confined to equipment reachable over cellular communications rather than the utility's main control network.
That's the harder problem for small-town water systems. Federal officials, following the Minnesota incidents, issued a broader warning to local water systems nationwide.
