Threats · 46 days ago
A single exposed control surface can let one disruptive campaign reach dozens of small water systems at once. The standard response would treat this as a local utility incident, but the real problem is that internet-facing PLCs give attackers a shared way into separate OT environments that were never meant to be managed as one target set.
MNIT says more than 30 Minnesota community water utilities were hit over July 26-27, and reporting now points to a likely Iran-affiliated actor behind the activity. CISA’s updated guidance also puts Rockwell Automation/Allen-Bradley, Schneider Electric, and Siemens PLCs in scope, and warns that any internet-exposed PLC can be a target.
That changes the containment problem. Even when drinking water and wastewater service keep running, the blast radius now includes manual operation, cross-site response coordination, and the possibility that one weak OT footprint can be used again across many small utilities.
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a… EPSS 51% (99th percentile).
CISA federal remediation date Mar 26 · date passed
11 sources covering this story
Minnesota Water Utility Attacks Expose Sector's Cyber-Risks
A likely Iran-backed actor targeted over 30 community water systems in Minnesota in a sobering reminder of rising threats to US critical infrastructure.
Investigators are chasing two open questions in the coordinated attack on Minnesota water systems: who was behind it, and whether a shared vulnerability in widely used industrial controllers made dozens of small utilities exploitable at once.
Coordinated cyberattack hits more than 30 Minnesota water utilities - Help Net Security
A coordinated cyberattack hit OT systems at 30+ Minnesota water utilities, prompting a statewide Minnesota IT Services (MNIT) response.
Iran-linked CyberAv3ngers suspected in attacks on Minnesota water systems
More than 30 facilities disrupted in 'coordinated cyberattack,' though officials have yet to name a culprit
Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline
A coordinated cyberattack targeted more than 30 Minnesota water systems, disrupting a plant and cellular links while affecting automated controls.
Hackers disrupt over 30 Minnesota water utilities in coordinated OT attack
The Minnesota IT Services (MNIT) agency activated its cybersecurity incident response capabilities across the entire state after hackers targeted more than 30 community water systems in
Dozens of Minnesota Water Utilities Targeted in Coordinated OT Attacks
State and federal agencies respond after intrusions disrupt automated controls at municipal water and wastewater utilities.
Risky Bulletin: Cyberattack disrupts Minnesota water utilities
A cyberattack has disrupted water utilities in more than 30 communities in Minnesota, Denmark tests a secondary banking system in case of [Read More
Minnesota & other US Water Cyber Attacks, CISA AA26-097A | Tenable®
Tenable's RSO discusses the coordinated cyber attack disrupting 30+ Minnesota water utilities and 12+ other states, and the July 2026 CISA Advisory AA26-097A
Coordinated cyberattack disrupts water utilities in 30+ Minnesota communities | StateScoop
A cyberattack of undetermined origin disrupted water treatment plants in at least 30 communities in Minnesota, according to the state's technology bureau.
Authorities investigating a coordinated cyberattack against Minnesota water systems
The two-day attack comes days after federal officials warned of state-linked threat groups targeting a wider set of industrial devices.
Part of the PlainSec briefing for 2026-07-30