Iranian Hackers Target Minnesota Water

July 31, 2026

A coordinated cyberattack tried to knock out drinking water in more than 30 Minnesota communities, and investigators say the fingerprints likely point to Iranian hackers.

Story Snapshot

More than 30 Minnesota community water systems were hit in a coordinated cyberattack against control equipment, not office computers.
Manual overrides by local crews kept drinking water safe, but at least one plant went offline for hours.
U.S. officials now suspect hackers linked to Iran, based on the methods used and lack of ransom demands.
Federal agencies are warning water utilities nationwide to lock down remote-control systems before the next strike.

What Happened To Minnesota’s Water Systems

Between Sunday and Monday, July 26–27, a coordinated cyberattack hit operational technology at more than 30 community water systems across Minnesota. Minnesota IT Services said the incident targeted the technology running local water systems, not simple office networks. In Braham, the city reported its water plant suddenly went offline and later confirmed the outage was caused by a “malicious cyber-attack” on computerized operating controls. Plymouth said two water towers and multiple wastewater lift stations tied together by cellular connections were affected. South St. Paul and Maple Plain also reported similar utility system attacks, all within a tight 48‑hour window.

State officials explained that the cyberattack disrupted the digital controls that run wells, pumps, towers, and lift stations, forcing staff to switch to manual operation. Braham said the well and treatment plant shut down but suffered no physical damage, and water safety was not harmed. Minnesota’s chief information security officer, John Israel, said his team was working with federal partners including the Federal Bureau of Investigation (FBI) to investigate who got in and how they moved across so many systems so quickly. Cities told residents they did not need to change water use, and no boil‑water advisories were issued.

Investigators See An Iranian Fingerprint

Multiple U.S. officials told reporters they suspect the attackers were hackers linked to Iran, based on the tools and tactics used in Minnesota. The New York Times reported that three state officials familiar with the investigation said analysts focused on the techniques and the fact that no ransom demand was made, which often points away from simple criminals and toward a hostile nation state. A separate ABC News report said authorities were looking into whether Iran or Iran‑associated hackers were behind the coordinated hits on more than 30 water plants. Other outlets noted that the attacks resembled earlier incidents tied to Iran‑aligned groups that target industrial control equipment.

Security researchers at Tenable, a major cybersecurity firm, said the Minnesota incident fits a pattern they track in a threat ecosystem known as CyberAv3ngers. The U.S. government has previously linked that group to the Islamic Revolutionary Guard Corps Cyber‑Electronic Command in Iran. Tenable pointed out that the timing of the Minnesota attacks lines up with growing activity against industrial controllers described in a recent federal advisory about Iranian‑affiliated operations. While Minnesota and federal agencies have not yet issued a formal public blame statement, the combination of similar methods, targets, and timing has pushed experts to treat an Iran link as the leading theory.

How The Attack Worked And Why It Matters

Reports say the hackers went after operational technology, the gear that physically runs water and wastewater systems, instead of basic information‑technology office networks. In Braham, the attackers shut down operating controls enough to stop the well and treatment plant until staff could step in. In Plymouth, the focus was on remote‑controlled water towers and wastewater lift stations connected over cellular links, showing that internet‑facing or cellular‑managed equipment was a key weak point. Tenable warned that similar attacks have recently abused known flaws in industrial controllers, including a major vulnerability in certain Rockwell Automation control devices that the government says Iranian‑affiliated actors have exploited.

Cyberattacks on Minnesota water systems investigated as officials warn about Iranian hackers https://t.co/UXcfqZy9Za pic.twitter.com/CYpKtlmewg

— This Is The Conversation Project (@th_conversation) July 31, 2026

Federal and state officials stressed that, despite the disruption, water quality stayed safe and there was no sign of contamination or long‑term delivery problems. But they also issued broader alerts, warning local water systems nationwide to harden remote‑access tools, separate office and control networks, and lock down cellular‑connected gear before copycat attacks hit other towns. For many communities, especially rural ones, water plants are now run by small teams using remote software and off‑the‑shelf cellular modems. That setup saves money but often leaves the most basic piece of daily life — clean water at the tap — exposed to foreign adversaries who have made clear they are willing to reach into American towns.

What This Means For Security And Sovereignty

For conservative readers, this story is not just about one state’s bad day; it highlights how hostile regimes test our defenses by going after small, local systems that families depend on. Iranian‑linked actors have already claimed or been suspected in other water‑sector intrusions, including cases in California where companies later scanned networks for signs of compromise. When enemies abroad can flip a digital switch and shut down wells in Middle America, it raises serious questions about past government neglect of critical infrastructure security and our continued reliance on fragile, internet‑exposed control gear. Under President Trump, federal agencies are now pushing utilities to add real firewalls, strict network separation, and stronger log monitoring, but many systems are still catching up.

Officials say the Minnesota investigation is still active, and they have not released full forensic details or named a culprit in an official statement. That means some technical questions — like the exact entry point, specific exploited devices, and full list of affected towns — remain open. But the core facts are clear: more than 30 American communities had their water operations disrupted, manual work saved the day, and analysts now treat Iranian‑linked hackers as the most likely source. For families who expect safe, steady water and a government that protects core services, this incident is a wake‑up call. Foreign adversaries are probing our systems close to home, and local leaders must treat digital locks on pumps and towers with the same seriousness as physical locks on city hall.