Minnesota water utilities — coordinated OT attack on 30+ community systems

What happened

Between Sunday 26 and Monday 27 July 2026, a coordinated cyberattack disrupted operational technology at water and wastewater utilities across more than 30 Minnesota communities in the same window. Minnesota IT Services (MNIT) described it as a coordinated attack targeting technology at community water systems statewide and activated a statewide cybersecurity response. Four cities disclosed publicly, and between them they sketch the shape of the operation.

In Braham, a town of roughly 1,700 people, the attack disabled computerised operating controls and temporarily shut down the city’s well and water treatment plant. Public works crews restored the plant manually within about two hours. In Plymouth, a city of around 80,000, the IT division deliberately disconnected cellular-connected equipment at two water towers and several wastewater lift stations to halt the attack and stop the kit being re-targeted while it was reconfigured, then ran operations through manual procedures. South St. Paul reported that some automated water utility controls were affected, and Maple Plain declared a local state of emergency to widen its response options.

In every confirmed case officials stated that drinking-water quality was not affected and no boil-water advisories were issued. The Minnesota Department of Health worked directly with the targeted systems. So the damage was operational and psychological rather than a public-health event: automated control was pulled offline, crews reverted to running plants by hand, and a state government found itself managing dozens of simultaneous incidents against small utilities that mostly lack dedicated security staff.

Federal and state officials have not formally attributed the attacks. The operational pattern, however, is consistent with CyberAv3ngers, the group the US government attributes to Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC) and which the industry also tracks as Storm-0784, Bauxite, Hydro Kitten and UNC5691. The timing is hard to ignore: CISA updated Advisory AA26-097A on 22 July, four days before the Minnesota weekend, warning that Iranian-affiliated actors were compromising internet-connected PLCs across US water, energy and government sectors.

How it worked

The attack surface here is the programmable logic controller — the small industrial computer that actually opens valves, runs pumps and holds the ladder logic a treatment plant depends on. CyberAv3ngers’ current campaign, documented in AA26-097A, does not rely on exotic malware. It reaches PLCs that are exposed directly to the internet and connects to them using the same vendor engineering software a legitimate operator would use: Rockwell Automation’s Studio 5000 Logix Designer, Schneider Electric’s EcoStruxure Control Expert and Siemens’ TIA Portal. Once connected, the actors download and modify controller project files and alter what operators see on their screens.

The vulnerability most directly associated with the campaign is CVE-2021-22681, a critical authentication bypass in Rockwell Automation’s Logix controllers carrying a CVSS score of 9.8. It stems from an insufficiently protected cryptographic key used to verify communication between Studio 5000 and Logix PLCs; anyone who can obtain or intercept that key can impersonate the engineering software and gain direct, unauthenticated access to the controller. It is not a zero-day — it was disclosed in February 2021 — but in-the-wild exploitation was not confirmed until March 2026, when Rockwell updated advisory SD1672 and CISA added the flaw to its Known Exploited Vulnerabilities catalogue. Crucially, Rockwell has stated the flaw cannot be fully fixed with a software patch. There is no update to deploy. The only remediation path is architectural: keep the controllers off the internet, segment the network, isolate engineering workstations and set the physical mode switch to “Run”.

The 22 July update to AA26-097A made the campaign materially more dangerous. It expanded the confirmed targeting from Rockwell devices to Schneider Electric and Siemens PLCs, documented actors exfiltrating PLC project files out of victim environments for the first time, and — most alarming — detailed manipulation of Add-On Instructions, the reusable code modules embedded in PLC programs. The FBI observed a case where a malicious project file kept normal-looking downstream ladder logic while inserting modified instructions that disabled safety-shutdown and alarm systems, and simultaneously falsified data on HMI and SCADA displays so equipment could be driven into unsafe conditions without alerting the operator. That is the difference between a nuisance outage and a genuine safety event.

Scale is the other half of the story. Censys counted 5,219 internet-exposed hosts globally that self-identify as Rockwell/Allen-Bradley devices, with 74.6% of them in the United States — many sitting on cellular carrier networks, exactly the field-deployed, modem-connected pattern that the Plymouth incident targeted. The EPA warned in 2024 that more than 70% of US water systems were failing to meet a legal requirement to maintain risk assessments, and an audit of 1,000 systems serving 193 million people found 97 with critical or high-risk vulnerabilities. With 150,000 to 170,000 mostly small, rural water systems in the country, the target set is effectively unlimited.

Timeline

• February 2021 — CVE-2021-22681 disclosed and mitigated; no full software patch possible.
• 7 April 2026 — CISA publishes Advisory AA26-097A documenting Iranian-affiliated actors exploiting internet-exposed Rockwell PLCs across US water, energy and government sectors; confirmed disruptions since at least March 2026.
• 22 July 2026 — CISA updates AA26-097A: scope expanded to Schneider Electric and Siemens PLCs, first documented PLC project-file exfiltration, and detection guidance for Add-On Instruction manipulation that disables safety and alarm logic.
• 26–27 July 2026 — Coordinated attack disrupts OT at 30+ Minnesota water and wastewater utilities over one weekend.
• 27 July 2026 — Braham’s well and treatment plant taken offline, restored manually in ~2 hours; Plymouth disconnects cellular-connected water-tower and lift-station equipment; South St. Paul reports affected automated controls; Maple Plain declares a local state of emergency; MNIT activates statewide response.
• 29 July 2026 — MNIT confirms the investigation remains active; no boil-water advisories issued and drinking-water quality reported unaffected across confirmed sites.

What defenders should learn

The first lesson is the uncomfortable one: there is no patch coming. CVE-2021-22681 cannot be fully remediated in software, which breaks the entire mental model of vulnerability-management teams who are used to waiting for a fix and deploying it. For a large class of OT assets, the “fix” is a network architecture decision, not a patch cycle. Any organisation whose remediation workflow ends at “apply the update” will never close this exposure.

The second is exposure itself. Every confirmed technique in this campaign depends on the PLC being reachable — from the open internet, from a cellular modem, or from an IT network that sits flat alongside the control systems. Pull that reachability away and the unauthenticated-attacker precondition disappears. The immediate, highest-impact actions are well established: take PLCs off direct internet exposure, put any necessary remote access behind an authenticated gateway with MFA, set physical mode switches to “Run” to block remote logic changes, audit and harden cellular OT connections, and keep tested offline backups of controller logic.

This is where the segmentation and Zero Trust lens goes deepest, and it is worth Andy expanding here. A water treatment PLC has an extremely narrow, predictable set of legitimate counterparties — a named engineering workstation, a historian, an HMI — and should never be reachable from a business network or the internet at large. Strong IT/OT segmentation both removes the initial access path and, because the campaign now includes project-file exfiltration, gives defenders a high-signal alert the moment a controller starts talking to somewhere it never normally talks to. The same principle that limits an attacker’s east-west movement inside a bank applies to a lift station in a town of 1,700; the blast radius of any single compromised device is a design choice made long before the attack.

Finally, the geopolitics are the strategic warning. This did not happen in a vacuum: it lands amid active US–Iran hostilities, and CyberAv3ngers’ techniques have already proliferated to dozens of affiliated groups replicating the playbook. Small utilities are being targeted precisely because they are soft — consumer-grade remote tools, flat networks, no OT security staff — and there are well over a hundred thousand of them. The Minnesota weekend was contained and caused no lasting harm, but it was also a rehearsal, run against the least-defended tier of critical national infrastructure, and it worked well enough to knock a plant offline.