On July 26–27, 2026, unknown attackers launched a coordinated cyberattack against the operational technology (OT) systems of more than 30 community water systems across Minnesota. The City of Braham was among the first to confirm publicly that its water plant went offline due to what it described as “a malicious cyber-attack of computerized operating systems by unknown actors.” The plant came back online within hours, with city officials confirming that water was “filtering and treating water as expected.” Other affected utilities, including the City of Maple Plain, were forced to switch to manual operations during the disruption, a contingency designed precisely for scenarios where computerized controls become unavailable or untrustworthy.
No confirmed harm to water quality or public health has been reported, but the scale — over 30 utilities hit in a coordinated fashion over two days — makes this one of the most significant attacks on US water infrastructure in recent years. Attackers on critical infrastructure OT systems often aim to pre-position for future disruption rather than cause immediate visible damage, making the lack of immediate impact less reassuring than it might appear. CISA and the FBI have previously advised water and energy operators to isolate key OT systems from internet-facing networks and maintain manual fallback procedures, guidance that appears to have helped limit the blast radius here. No threat actor has claimed responsibility; state-sponsored groups have repeatedly been observed probing US water infrastructure.