Minnesota investigates coordinated cyberattack on over 30 water systems

A coordinated cyberattack on operational technology affected more than 30 community water systems across Minnesota on Sunday and Monday, prompting state officials to launch a coordinated response. Minnesota IT Services (MNIT) confirmed the attacks did not involve ransom demands and that water service to residents remained uninterrupted, though the agency withheld the names of affected communities citing confidentiality rules.

In Plymouth, officials detected equipment malfunctions Sunday night and switched to manual operations as a precaution. > "There wasn’t a hiccup in any service to the public," said Michael Thompson, Plymouth’s public works director, adding that safety checks and manual controls ensured water quality and quantity were maintained. Similar temporary issues were reported in other municipalities, including Maple Plain and South St. Paul. In Braham, the system was offline for under two hours on Monday before crews restored service, with Mayor Nate George noting that residents did not run out of water.

State authorities said the incidents highlight the vulnerability of critical infrastructure. MNIT’s annual report recorded nine cyberattacks on critical infrastructure statewide in the previous year; the current event involves more than 30 water utilities simultaneously. Governor Tim Walz’s administration has previously issued an executive order requiring annual cybersecurity assessments and reporting for such utilities.

Law enforcement agencies, including the Minnesota Bureau of Criminal Apprehension and the FBI, are investigating the attacks alongside state, tribal and federal partners. > "Cyberattacks against critical infrastructure require a coordinated, whole-of-government response," said John Israel, MNIT assistant commissioner and chief information security officer, emphasizing ongoing efforts to share intelligence, support affected communities and strengthen defenses.