Cyberattacks Disrupt 30+ Minnesota Water Utilities, Trigger Security Response
Over 30 Minnesota water utilities suffered coordinated cyberattacks that disrupted operations in July 2026.
Why it matters: Legal and compliance professionals must anticipate heightened regulatory scrutiny and potential litigation risks following cyberattacks on critical water infrastructure.
- Cyberattacks occurred from July 26 to 27, 2026, affecting more than 30 Minnesota water utilities.
- Impacted cities include Plymouth, South St. Paul, Maple Plain, and Braham, where water controls were temporarily lost.
- In February 2026, the EPA highlighted rising cyber risks to water utilities in a Threat Briefing.
- The EPA, FBI, CISA, and NSA linked the attacks to Iranian-affiliated hackers in an April 2026 joint advisory.
Between July 26 and 27, 2026, over 30 water utilities in Minnesota were hit by coordinated cyberattacks that disrupted service operations. Cities affected included Plymouth, South St. Paul, Maple Plain, and Braham. In Braham, water treatment and well controls were briefly disabled, forcing reliance on stored reserves in a water tower during the outage.
The U.S. Environmental Protection Agency (EPA), Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and National Security Agency (NSA) attributed the attacks to Iranian-affiliated threat actors. These agencies issued a joint advisory in April 2026 warning about ongoing cyber threats targeting water and wastewater systems from Iranian operators (EPA.gov advisory).
Earlier in the year, the EPA held a water-sector Threat Briefing on February 26, 2026, outlining escalating cyber, physical, and AI-related vulnerabilities faced by water utilities (WaterOnline). The agency also mandated that water utilities demonstrate cyber resilience during a National Cybersecurity Drill on July 8, 2026, by operating without SCADA systems, cloud access, email, and VoIP (EPA National Cybersecurity Drill).
Jess Kramer, EPA Assistant Administrator for Water, emphasized, "Cybersecurity threats pose significant risks to our nation's water infrastructure, affecting communities, hospitals, and critical sectors reliant on these services." This attack underscores the urgency for enhanced cybersecurity measures in water utilities.
For legal and compliance professionals advising clients in critical infrastructure sectors, these events signal increasing regulatory scrutiny and raise potential liability risks related to cybersecurity breaches. Organizations must therefore prepare for evolving compliance standards and possible litigation outcomes.
By the numbers:
- 30+ — number of Minnesota water utilities disrupted between July 26-27, 2026
- February 26, 2026 — EPA water-sector Threat Briefing date
- April 2026 — issuance date of joint advisory linking attacks to Iranian hackers
What's next: Legal and cybersecurity teams should monitor forthcoming EPA guidance updates and compliance deadlines following the National Cybersecurity Drill results.