TL;DR
- what: A coordinated cyberattack struck operational technology at more than 30 Minnesota community water systems over July 26 and 27, 2026, knocking Braham's treatment plant offline and disrupting automated controls in Plymouth, South St. Paul and Maple Plain.
- impact: At least one plant stopped treating water, cellular links to two water towers and multiple wastewater lift stations failed, Maple Plain declared a local state of emergency, and parallel incidents in at least seven states caused loss of pressure and flooding.
- fix: The FBI, EPA and CISA direct operators to pull Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 PLCs off the public internet, change default and reused controller credentials, log cellular modem connections, and inspect running project files and ladder logic for unauthorized changes before validating backups and returning controllers to run mode.
- who: Water and wastewater utilities running internet-exposed PLCs and HMIs, especially small systems with no dedicated OT security staff, plus any operator of Rockwell, Schneider Electric or Siemens controllers reachable from the internet.
Over two days, attackers reached the operational technology behind more than 30 Minnesota community water systems. Braham's water plant went offline and the city told residents to minimize water use until treatment resumed. Plymouth lost cellular communications to two water towers and multiple wastewater lift stations and fell back to manual operation. South St. Paul and Maple Plain kept water flowing after automated utility controls were affected, with Maple Plain declaring a local state of emergency to support its response. This was not opportunistic scanning that tripped an alarm. Minnesota IT Services (MNIT) says the incidents shared timing, access methods and target infrastructure.
What Actually Happened
The activity ran on July 26 and 27, 2026, and triggered a statewide cybersecurity response. MNIT confirmed to The Hacker News that more than 30 water systems were impacted, though the nature and extent varied by system and the investigation is still determining how many experienced true operational disruptions. By July 28 the agency said it was not aware of any active requests for residents to change their drinking-water use, meaning no boil advisories or contamination events had been tied to the intrusions.
- Braham: water treatment plant taken offline, residents asked to reduce consumption until treatment resumed
- Plymouth: cellular communications failures at two water towers and multiple wastewater lift stations, operations continued manually
- South St. Paul: automated utility controls affected, service maintained
- Maple Plain: automated utility controls affected, local state of emergency declared to support response
MNIT is coordinating containment, investigation, recovery and threat-intelligence sharing with CISA, the EPA, the FBI and the affected utilities. "Cyberattacks against critical infrastructure require a coordinated, whole-of-government response," said John Israel, MNIT assistant commissioner and Minnesota CISO. The agency credits that coordination with preventing more serious impacts to critical services.
The PLC Angle: MicroLogix 1100 and 1400 Exposed to the Internet
On July 30, the FBI and EPA issued a separate warning that water and wastewater utilities in at least seven states had reported incidents since July 27 involving internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers. This is the concrete technical detail Minnesota officials have withheld, and it is the most actionable part of the story.
- Attackers remotely changed PLC IP addresses and passwords, causing loss of monitoring and control at the affected sites
- Some incidents degraded water operations, with reported effects including loss of pressure and flooding
- At least one organization discovered modified PLC project files after spotting ladder-logic discrepancies across several sites
- The FBI has only observed the activity against MicroLogix 1100 and 1400 models, but advises operators of other PLC brands to apply the same protections
⚠️ Changing the IP and password is a persistence play, not vandalism — When an attacker rewrites a controller's IP address and password, the operator loses monitoring and control while the logic keeps running. That is the worst combination: the process continues to execute whatever it was last told to do, and nobody upstream can see it or stop it. Modified project files found through ladder-logic discrepancies across multiple sites suggest the goal was durable control, not a quick defacement.
Attribution: The Pattern Fits CyberAv3ngers
No one has named the attacker. MNIT says the similarities it observed are consistent with activity federal partners have seen in other states and industries, but investigators cannot yet determine whether a single actor is responsible for all the incidents. Attribution has not been finalized, and the agency is withholding specific technical details while the investigation continues.
Four days before the Minnesota attacks, U.S. agencies expanded a warning about Iranian-affiliated actors targeting internet-facing PLCs from Rockwell Automation, Schneider Electric, Siemens and potentially other manufacturers. In that campaign, investigators observed attackers exfiltrate and modify project files, manipulate what operators saw through HMI and SCADA displays, and disable shutdown and alarm logic. Officials have not publicly connected that campaign to Minnesota.
Tenable told The Hacker News the timing and operational pattern were consistent with the broader CyberAv3ngers threat ecosystem. "While MNIT did not provide attribution, these tactics remain consistent with the tradecraft attributed to CyberAv3ngers and other IRGC-CEC affiliated groups, who have been known to target critical infrastructure since at least 2023," said Scott Caveza, senior staff research engineer at Tenable. U.S. agencies have previously warned that groups affiliated with Iran's IRGC Cyber-Electronic Command have hit water and wastewater systems through PLCs and HMIs, in some cases causing operational interruptions.
Why Water Utilities Keep Being the Target
Community water systems are the softest large target in U.S. critical infrastructure. Many serve a few thousand residents with a handful of staff and no dedicated security personnel. Remote sites, water towers, lift stations and booster stations are frequently connected over cellular modems because running fiber is impractical, and those modems put controllers one misconfiguration away from the public internet. The PLCs themselves are long-lived hardware chosen for reliability, not for authentication. A MicroLogix 1100 or 1400 reachable from the internet with a default or shared password is not a vulnerability that needs an exploit. It is a login.
What Operators Should Do Now
- Inventory every PLC, HMI and cellular modem with a route to the internet. Assume shadow connectivity exists at remote sites you did not commission yourself.
- Remove internet-facing controllers from public reachability. If remote access is required, put it behind a VPN with MFA and restrict controller access to specific authorized systems.
- Change default and reused credentials on every controller, not just the MicroLogix models named by the FBI.
- Log cellular modem connections, per CISA guidance, and alert on unexpected source addresses or configuration changes.
- Inspect running project files for unauthorized changes and compare ladder logic across sites. The organization that caught modified project files did so by spotting discrepancies between sites.
- Validate backups before restoring anything. Restoring a compromised project file recreates the problem.
- Where a controller has a physical mode switch, return it to run mode only after validating its project files.
Cross-site logic comparison is the highest-value detection you can run this week — If you operate multiple sites with similar processes, diffing ladder logic and project files across them is cheap and catches changes that no signature-based tool will. It is exactly how one affected organization discovered modified PLC project files. Do it before you restore from backup, not after.
Bottom Line
Thirty-plus systems in a single state over two days, then reports from at least seven states within a week, is a campaign operating at scale against targets that were never designed to resist it. The specific technical detail worth acting on is narrow and clear: internet-facing MicroLogix 1100 and 1400 PLCs, with IP addresses and passwords rewritten remotely to take away monitoring and control. Minnesota has not confirmed a PLC family or access method, and no attribution has been finalized. Treat the FBI and EPA advisory as the working baseline. If you run water or wastewater OT, the exposure check is a one-day exercise and the alternative is finding out the same way Braham did.
Originally published on RedEye Threat Intelligence.
Top comments (0)