Cyberattacks Hit Minnesota Water Systems: CISA Issues Urgent Warning
Following attacks on 30+ water utilities, CISA calls for immediate removal of internet-exposed PLCs.
1Coordinated Attack on Minnesota Water Systems
A coordinated cyberattack targeted operational technology at over 30 community water systems in Minnesota on July 26-27. Minnesota IT Services (MNIT) immediately activated statewide cybersecurity incident response capabilities. Cities like Braham, Maple Plain, Plymouth, and South St. Paul were affected. Braham's water treatment plant, serving 1,700 residents, was completely knocked offline in the hardest hit of the attacks.
2Behind the Attacks: CyberAv3ngers
While no formal attribution has been made, Tenable researchers assess the operational pattern aligns with Iran-linked CyberAv3ngers, a group formally tied to Iran's Islamic Revolutionary Guard Corps Cyber-Electronic Command by the U.S. government. The attacks came just four days after CISA updated its advisory about Iranian-affiliated actors targeting PLCs across U.S. critical infrastructure.
3How PLCs Are Being Targeted
Attackers remotely access internet-exposed PLCs, change passwords and IP addresses to lock out operators. They're actively exploiting CVE-2021-22681, a critical Rockwell Automation vulnerability (CVSS 9.8) with no available patch. Network isolation has become the essential compensating control. The simplicity of these attacks - exploiting default or weak credentials on internet-facing hardware - makes them particularly dangerous.
4Impact of the Attacks
The attacks resulted in boil water notices and forced some facilities to switch to manual operations. The FBI confirmed PLC-related incidents at utility companies in at least seven states. Recent attacks have expanded beyond Rockwell Automation to include Schneider Electric and Siemens devices. For the first time, attackers stole PLC project files to study plants' engineering logic offline.
5CISA's Urgent Alert
CISA warns of a significant increase in cyber threats targeting PLCs in the Water and Wastewater Systems Sector. They urge critical infrastructure owners to immediately remove publicly exposed OT systems. The alert notes that cellular modems installed by operators or vendors may not be documented or included in routine scans, creating unseen vulnerabilities.
6Why Small Utilities Are Targets
CyberAv3ngers is known for targeting small water and municipal facilities, considered low-hanging fruit in U.S. critical infrastructure. Even small communities like Braham (population 1,700) suffered severe impacts. CISA emphasizes that water organizations of all sizes are being targeted, and even those with mature cybersecurity must validate external connections.
7Long-Term Threats Emerging
The theft of PLC project files indicates attackers are studying plants' operational logic for future targeted attacks, not just causing immediate disruption. CISA's July 2026 advisory update documents this expansion of tactics, along with new guidance to detect tampering with reusable code modules in industrial control programs.
8Recommended Mitigations
CISA recommends critical infrastructure operators immediately remove internet-exposed OT systems, validate all external connections (including undocumented cellular modems), and implement network isolation. Internet-exposed OT assets carry increased risks of operational disruptions, configuration changes, and in severe cases, physical damage. Compensating controls are essential given unpatched vulnerabilities in critical systems.