A coordinated cyberattack struck operational technology at more than 30 community water systems in Minnesota, including Plymouth, and affected at least six other states on Sunday, July 26, and Monday, July 27, 2026, state officials said. The attack degraded water operations in some areas and caused outages, such as in Braham where the water plant went offline for an unknown reason.

Federal agencies including the Cybersecurity and Infrastructure Security Agency (CISA), the FBI, and the Environmental Protection Agency (EPA) are investigating the incident. They warn that Iran-affiliated threat actors are targeting critical infrastructure, including local utility systems.

Weeks before the attack, CISA had issued warnings about exposed programmable logic controllers vulnerable to such strikes. On July 28, CISA published international guidance titled "CI Fortify: Advice for Isolating Vital Systems," urging critical infrastructure operators to separate vital operational technology from less trusted networks to enhance security.

National correspondent Madeleine Rivera reports that the investigation highlights the national security implications of cyber threats on community water systems. Meanwhile, other communities reported issues involving automated controls or communications equipment related to the attack.

State officials have not issued any active requests for residents to reduce or change their drinking water use following the incident.

Sources