Key Takeaways

• More than 30 Minnesota community water systems were targeted across July 26 and 27, 2026 in what Minnesota IT Services (MNIT) has characterized as a coordinated cyberattack. Automated control functions were affected at several utilities, and the City of Braham briefly took its water treatment plant offline [4][6][9].
• No attribution has been made. Officials have not named a threat actor, identified an exploited vulnerability, confirmed which products were affected, or established whether data was taken [4][7].
• The incidents followed four days after the July 22 update to joint advisory AA26-097A, which widened observed Iranian-affiliated targeting of internet-facing programmable logic controllers (PLCs) from Rockwell Automation equipment to include Schneider Electric and Siemens devices [1][3].
• The City of Plymouth reported that impact was confined to equipment reached over cellular links. Remote assets — water towers, lift stations, pump stations — frequently sit outside the boundary of formal risk and vulnerability assessments [4][10].
• The consequence class here is loss or manipulation of view and control, not data loss. Operators in the UK and Europe carry equivalent exposure, under a regulatory regime that is tightening as the UK Cyber Security and Resilience Bill progresses through Parliament [16].

Why This Incident Matters Now

A joint advisory told critical infrastructure operators, in specific terms, that state-linked actors were reaching internet-facing PLCs at water and wastewater utilities and manipulating what those controllers do. Four days later, more than 30 water systems in a single US state reported disrupted automated controls over a 48-hour period.

Whether the two events are connected has not been established publicly, and this analysis does not assume they are. The more useful question for security leaders is what the sequence reveals about the distance between a warning being issued and a warning being actioned. Advisory AA26-097A has been in circulation since April 7, 2026 [1]. Its July update did not describe a novel technique. It broadened the list of affected manufacturers and added detection guidance. For any operator running an internet-reachable controller from one of the named vendors, the required response was already documented, already free, and already several months old.

The Minnesota incidents are therefore worth examining less as a novel threat and more as a measurement of how much of the sector is positioned to act on advisories at the speed at which they are now being issued.

What Actually Happened in Minnesota

MNIT confirmed that more than 30 community water systems were targeted on July 26 and 27, 2026, and activated a statewide cybersecurity incident response [4][6][8]. The agency is coordinating with CISA, the Environmental Protection Agency (EPA), the FBI, state agencies and affected utilities [5][6]. The FBI has confirmed it is in contact with victims [6].

Four cities disclosed incidents publicly: Braham, Maple Plain, Plymouth and South St. Paul [4][9][10][11][12]. The reported pattern is consistent across them. Automated control functions were affected; contingency procedures were activated; in most cases water and wastewater operations continued. Braham took its treatment plant offline after detecting the incident and asked residents to limit water use, later reporting that the attackers had shut down operating controls, taking the well and treatment plant with them [4][9]. Maple Plain declared a local state of emergency to support its response [5][12]. South St. Paul reported that manual intervention by public works staff maintained normal operations despite the loss of some automated controls [4][11]. Plymouth attributed communications problems at two water towers and multiple lift stations to the incident, and stated that the impact was limited to equipment connected via cellular communications [4][10].

The affected cities have consistently informed residents that drinking water remains safe. MNIT stated on July 28 that it was aware of no active requests for residents to alter their water use [5].

Several material facts remain unpublished. MNIT has not released a full list of affected systems. No exploited vulnerability, affected product line or exfiltration finding has been made public. No actor has been named. Iranian-affiliated groups such as CyberAv3ngers and Handala fit the profile of the activity, and several outlets have noted the resemblance, but investigators have stressed that formal attribution has not been made [4][7]. Analysts should treat the attribution question as open.

What Changed in Advisory AA26-097A on July 22

Advisory AA26-097A was first published on April 7, 2026 by the FBI, CISA, the NSA, the EPA, the Department of Energy and US Cyber Command’s Cyber National Mission Force. It documented Iranian-affiliated advanced persistent threat (APT) actors exploiting internet-connected operational technology (OT) devices across the Government Services and Facilities, Water and Wastewater Systems, and Energy sectors, with confirmed disruption at victim organizations since at least March 2026 [1][2].

The July 22 update made three substantive changes [1][2][3].

Manufacturer Scope Widened

Observed targeting now extends beyond Rockwell Automation and Allen-Bradley controllers to Schneider Electric and Siemens PLCs, and potentially other branded devices. Specific models are named in the advisory, including Rockwell CompactLogix and Micro850, Schneider Modicon M340, and the Siemens S7-1200 series [3].

Detection Guidance for Reusable Code Modules

The update adds guidance on identifying malicious modifications to reusable logic — Add-On Instructions within Rockwell programs, for example — including validating project files and comparing running logic against a known-good baseline [3].

A Refreshed Indicator Set and a New Co-Authoring Agency

The update publishes a refreshed set of indicators of compromise, and the Department of the Treasury is added as a co-authoring agency [1][17].

The access method described in the advisory is the part that should concern operators most, because it is not a vulnerability in the conventional sense. Actors reach internet-exposed controllers from leased overseas hosting infrastructure and connect using the manufacturers’ own engineering software — Studio 5000 Logix Designer, EcoStruxure Control Expert, TIA Portal — the same tooling legitimate engineers use [1][3]. Connections made this way are difficult to separate from authorized administrative activity. From there, the advisory documents modification of control logic, disabling of alarm and shutdown functions, and alteration of data presented on operator displays [3].

Water and Wastewater Systems is named explicitly among the targeted sectors, and internet-exposed PLCs remain the primary access point [3].

Who Is Affected by Internet-Exposed OT?

US Water and Wastewater Operators

The sector’s risk profile varies enormously by resource level. Large municipal utilities often run segmented networks, dedicated security staff and formal asset lifecycle management. Most community water systems are small municipal utilities or rural cooperatives, some serving only a few hundred customers, without dedicated cybersecurity personnel or continuous monitoring [14]. A technique that a well-resourced utility would contain quickly can cause prolonged operational impact in a small system. The EPA leads federal water sector cybersecurity efforts but has no explicit statutory authority to mandate cybersecurity measures, relying on voluntary engagement and technical assistance [15].

UK and European Operators

Drinking water is an in-scope sector under the UK’s NIS Regulations 2018, and the UK Cyber Security and Resilience (Network and Information Systems) Bill would expand obligations, incident reporting requirements and regulatory powers across those sectors [16]. The Bill received its second reading in the House of Lords on July 14, 2026 [16]. The technical exposure is not materially different: the same vendors, the same engineering tooling, and the same practice of reaching remote assets over public networks.

Critical National Infrastructure (CNI) Operators in Other Sectors

Energy and government facilities are named alongside water in AA26-097A. Any organization running the named controller families in an internet-reachable configuration is within the described targeting scope, regardless of sector [1][3].

System Integrators and OT Suppliers

Where control system architecture is delivered by an integrator, the connectivity decisions — including secondary and backup communication paths — are frequently made outside the asset owner’s direct visibility. Under the Cyber Security and Resilience Bill, suppliers to regulated entities face obligations of their own [16].

What Are the Practical Challenges for Operators?

Remote Assets Are the Architecture’s Blind Spot

Plymouth’s disclosure that impact was limited to cellular-connected equipment is the most operationally instructive detail released so far. Water towers, lift stations and pump stations commonly report back to supervisory control and data acquisition (SCADA) systems over cellular modems, and these secondary or alternative communication links are routinely omitted from risk and vulnerability assessments [4]. This is not a new failure mode. In the 2020 attacks on Israeli water facilities, actors linked to the Iranian government used vulnerable cellular routers as the point of entry [4]. An assessment scoped to the plant boundary will not find a modem on a tower six miles away.

The Relevant Consequence Is Not Data Loss

In MITRE ATT&CK for industrial control systems (ICS) terms, the consequences at stake are denial or loss of view, denial or loss of control, and manipulation of view or control [4]. A physical process can continue running while operators lose the ability to see or influence it. Manipulation is the more dangerous case, because the process may be in a state that differs from what the screens report — precisely the scenario AA26-097A describes when it documents altered operator display data [1][3]. Detection strategies built around data exfiltration will not register any of this.

Advisory Volume Exceeds Absorption Capacity

Four days is a short interval between an advisory update and a sector-wide incident, but the underlying advisory was nearly four months old. The constraint is not awareness. It is the engineering time to inventory controllers, establish logic baselines, remove internet exposure and rehearse manual operation — work that competes with statutory obligations for water quality, capital works and day-to-day service delivery.

Attribution Absorbs Attention That Belongs Elsewhere

Whether the Minnesota incidents prove to be Iranian-affiliated changes very little about the required response. The controls that reduce exposure to this activity are the same controls regardless of who is behind it, and waiting for attribution before acting concedes time to the adversary.

How IOActive Can Help

IOActive’s work in critical infrastructure spans the technical and strategic worlds of OT and ICS security, from the semiconductor inside a controller to the governance program around it. Our team has operated in ICS environments since building the first proof-of-concept worm against the smart grid in 2009 [20], and has helped define standards and best practices including NIST 800-53 and 800-37. The two gaps this incident exposes are assessment problems before they are tooling problems: assessment scope that stops at the plant boundary and misses remote, cellular-connected assets, and the absence of an authoritative baseline against which controller logic can be validated. The services below address each directly.

Full Stack Security Assessments

Most providers scan at the network or application layer only. Our Full Stack Security Assessments examine the entire environment, drilling down to the facility and silicon level and up through the personnel, process, and supply-chain layers around it. For a water or wastewater operator, that means scoping to the whole estate rather than the plant boundary — the towers, lift stations and pump stations that report back over cellular modems, the OT/IT boundary, and the third-party managed links that are frequently the only route in. Drawing on our hardware research background, it also extends to the firmware and silicon of PLC and human-machine interface (HMI) devices themselves through penetration testing, reverse engineering, side-channel analysis, and fault injection. It is the same class of work behind our research Compromising Industrial Facilities from 40 Miles Away, which showed how a memory-corruption flaw in widely deployed industrial wireless automation devices could be exploited remotely to disable field sensor nodes — exactly the kind of remotely reachable field connectivity that Plymouth’s disclosure points to [18].

Red Team and Purple Team Services

Manipulation of view and control is the consequence class that matters here, and it is precisely what adversarial testing exists to surface. Our Red Team engagements emulate the tradecraft AA26-097A describes, including the “living off the land” use of vendors’ own engineering software in place of exploits, while our Purple Team work translates those findings into measurable improvements in whether your operators and analysts would actually detect unauthorized logic changes in time to act. It is the tabletop in step 6 below, run against the live environment rather than a whiteboard. IOActive research has repeatedly shown how attackers can blind the humans in the loop: our study SCADA and Mobile Security in the IoT Era found that more than 20% of the vulnerabilities identified across dozens of ICS mobile applications could let an attacker misinform operators or influence the industrial process directly [19].

Supply Chain Integrity

Where control system architecture is delivered by an integrator, connectivity decisions — including secondary and backup communication paths — are frequently made outside the asset owner’s visibility, and AA26-097A documents the vendors’ own configuration software being used as the access channel. Our Supply Chain Integrity service assesses the security posture of technology providers and critical third parties, reviewing firmware, embedded systems, remote-access arrangements, and procurement processes for inherited risk before it becomes an incident vector. Under the UK Cyber Security and Resilience Bill, suppliers to regulated entities will carry obligations of their own [16].

Secure Development Lifecycle

The advisory urges device manufacturers to adopt secure-by-default design rather than leaving operators to compensate for exposed controllers [1]. For the vendors and OEMs in the PLC, remote terminal unit (RTU) and HMI supply chain, our Secure Development Lifecycle work embeds security review into design and engineering — from threat modeling through code review and pre-release testing — so that the next generation of devices does not ship with the internet-reachable defaults this campaign depends on.

Advisory Services

Removing internet exposure is an architectural program, not a one-time patch, and there is no CVE here to wait for. Our Advisory Services — spanning programmatic security review, security program development and management, and Virtual CISO support — help water sector leaders and boards turn an advisory into a prioritized remediation plan, close the gap between a warning being issued and a warning being actioned, and prepare for the reporting obligations that arrive with an incident: Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) timelines in the US, and current and forthcoming NIS duties in the UK [15][16].

What Are the Recommended Next Steps for Operators?

1. Establish whether any controller is reachable from the internet. This means verification against the live estate, not a review of the network diagram. Include devices reached over cellular, satellite, radio and any third-party managed link, in line with the joint NCSC-UK, CISA and FBI secure connectivity principles for OT [13].
2. Extend assessment scope to every remote asset. Towers, lift stations, pump stations and any site with an independent communications path. Where an integrator built the connectivity, request the full inventory of links in writing.
3. Capture an offline logic and configuration baseline for every controller. This is both a detection capability and a recovery capability. Without it, comparing running logic to known-good logic — the core of the advisory’s new detection guidance — is not possible.
4. Apply the AA26-097A mitigations directly. Remove direct internet exposure, change default credentials on PLCs and HMIs, enforce multi-factor authentication on all remote OT access, and enable controller key switches or run/program mode protections where the platform supports them [1][3].
5. Ingest the refreshed indicators and hunt for engineering software activity. Look specifically for vendor engineering tooling running on hosts that are not designated engineering workstations, and for connections to controllers from unexpected sources [1].
6. Rehearse the manipulation scenario, not the outage scenario. Run a tabletop in which operator displays report normal conditions while the process deviates. The exercise should establish how staff would detect the discrepancy, what independent instrumentation exists, and how manual operation would be initiated and sustained.
7. Verify that incident reporting obligations are understood before they are triggered. For US utilities, CIRCIA reporting timelines; for UK operators, current and forthcoming NIS obligations under the UK Cyber Security and Resilience Bill [15][16].

Conclusion

The Minnesota utilities appear to have avoided serious consequences largely because staff reverted to manual operation and contingency plans held. That is a real result, and it reflects institutional competence that deserves acknowledgment. It is also a thin margin, and it depended on operators noticing that something was wrong.

The uncomfortable element of this incident is not that it happened without warning. It is that the warning was issued, updated, distributed through federal channels and sector information sharing and analysis centers (ISACs), and reported in the trade press — and the interval between that warning and disrupted controls in more than 30 communities was four days. Advisories are only a control if the organization receiving them has the capacity to act. For much of the water sector, on both sides of the Atlantic, that capacity is the constraint that needs addressing, and it will not be resolved by another advisory.

If you would like to discuss how your organization’s controller exposure and remote-asset connectivity measure up against the activity described here, or how IOActive can support your OT/ICS resilience program, we welcome the conversation.

References

[1] CISA, FBI, NSA, EPA, DOE, CNMF and US Department of the Treasury. Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure (AA26-097A), published April 7, 2026, updated July 22, 2026. https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a

[2] Internet Crime Complaint Center (IC3). Advisory AA26-097A (PDF), July 22, 2026. https://www.ic3.gov/CSA/2026/260722.pdf

[3] WaterISAC. (TLP:CLEAR) CISA Updates Iranian-Affiliated PLC Targeting Advisory (AA26-097A), July 2026. https://www.waterisac.org/tlpclear-cisa-updates-iranian-affiliated-plc-targeting-advisory-aa26-097a

[4] E. Kovacs. Dozens of Minnesota Water Utilities Targeted in Coordinated OT Attacks, SecurityWeek, July 29, 2026. https://www.securityweek.com/dozens-of-minnesota-water-utilities-targeted-in-coordinated-ot-attacks/

[5] Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline, The Hacker News, July 2026. https://thehackernews.com/2026/07/coordinated-cyberattack-targets-30.html

[6] Authorities investigating a coordinated cyberattack against Minnesota water systems, Cybersecurity Dive, July 28, 2026. https://www.cybersecuritydive.com/news/authorities-investigating-a-coordinated-cyberattack-against-minnesota-water/826427/

[7] Coordinated cyberattack disrupts water utilities in 30+ Minnesota communities, StateScoop, July 28, 2026. https://statescoop.com/coordinated-cyberattack-disrupts-water-utilities-in-30-minnesota-communities/

[8] Hackers target over 30 Minnesota water utilities in coordinated OT attack, BleepingComputer, July 29, 2026. https://www.bleepingcomputer.com/news/security/hackers-target-over-30-minnesota-water-utilities-in-coordinated-ot-attack/

[9] City of Braham. Cyber security incident statements, July 2026. https://brahammn.gov/

[10] City of Plymouth. News release, July 2026. https://www.plymouthmn.gov/Home/Components/News/News/8977/542

[11] City of South St. Paul. News release, July 2026. https://www.southstpaulmn.gov/m/newsflash/Home/Detail/900

[12] City of Maple Plain. Press Release: Cyber Security Incident, July 2026. https://www.mapleplainmn.gov/administration/page/press-release-cyber-security-incident

[13] NCSC-UK, CISA, FBI and international partners. Secure Connectivity Principles for Operational Technology, January 2026. https://www.cisa.gov/news-events/news/cisa-uk-ncsc-fbi-unveil-principles-combat-cyber-risks-ot

[14] Testimony before the US Senate Committee on Environment and Public Works. The Cybersecurity State of the Water Sector, February 4, 2026. https://www.epw.senate.gov/public/_cache/files/5/3/53d93dfe-ed8c-4e48-b705-0b16cb92c90a/FA38A32EE48D7F3D4B0C069FDC08A69E6327376EB85838A03310B2E91C8582C1.02-04-2026-dr.-simonton-testimony.pdf

[15] Nossaman LLP. Water Utilities: Congress Temporarily Extends Cyber Laws, EPA Releases New Guidance, November 2025. https://www.nossaman.com/newsroom-insights-water-utilities-congress-temporarily-extends-cyber-laws-epa-releases-new-guidance

[16] House of Lords Library. Cyber Security and Resilience (Network and Information Systems) Bill: HL Bill 32 of 2026–27, June 2026. https://lordslibrary.parliament.uk/research-briefings/lln-2026-0032/

[17] ComplianceHub. CISA Updates AA26-097A: Iranian-Affiliated PLC Targeting Widens to Schneider and Siemens, July 2026. https://compliancehub.wiki/cisa-aa26-097a-update-iranian-plc-targeting-critical-infrastructure-july-2026/

[18] IOActive. Compromising Industrial Facilities from 40 Miles Away (white paper). https://www.ioactive.com/wp-content/uploads/2018/05/IOActive_Compromising_Industrial_Facilities_from_40_Miles_Away.pdf

[19] IOActive (A. Bolshev, I. Yushkevich). SCADA and Mobile Security in the IoT Era. https://www.ioactive.com/scada-and-mobile-security-in-iot-era/

[20] M. Davis, IOActive. Advanced Metering Infrastructure (Smart Grid) Device Security, Black Hat USA 2009. https://blackhat.com/presentations/bh-usa-09/MDAVIS/BHUSA09-Davis-AMI-SLIDES.pdf