Minnesota Public Radio News
State technology officials say more than 30 Minnesota municipal water systems were targeted in a coordinated cyberattack this week.
In at least one case, a city’s well and treatment plant were temporarily knocked offline Monday. Other cities reported that the attack targeted communications and automated operations within their water system — forcing a move to manual workarounds.
The attack prompted Minnesota IT Services to activate a statewide cybersecurity incident response involving local, state and federal agencies. Authorities did not say whether they know who is responsible for the cyberattack and did not elaborate on a possible motive.
Officials said water in the affected cities remains safe to drink.
“MNIT is working side by side with our partners to share intelligence, support affected communities, and help utilities restore operations safely while strengthening defenses against future attacks,” John Israel, MNIT’s assistant commissioner and the state’s chief information security officer, said in a news release Tuesday.
“This incident demonstrates why Minnesota has invested in strong cybersecurity capabilities and partnerships. Our response worked as intended, enabling agencies at every level of government to rapidly coordinate, contain the incident, and help prevent more serious impacts to critical services,” Israel said.
The city of Braham reported that the attack targeted the computerized operating systems for its well and water treatment plant.
Mayor Nate George told MPR News that a water plant operator noticed a problem Monday morning: The city’s water tower needed to draw in water, but the well wasn’t working.
“There was power — but there was no controls, you know, telling the water where to go,” he said.
The city alerted Braham residents to limit water use, to keep the water in the tower from running out. An investigation found that a cyberattack caused the outage.
“They were able to hack into the control system of the of the well and just turn the well off, basically,” George said.
Within an hour and a half, city staff got the system back up and running. The city said the attack “did not alter or cause any issue to the physical water plant or water quality or safety.”
The cities of Maple Plain, Plymouth and South St. Paul reported issues with automated controls and communications for their water systems.
“The issue is limited to equipment connected via cellular communications within the system, and crews have continued operating as normal through manual procedures,” the city of Plymouth reported Monday evening.
Michael Thompson is the public works director in Plymouth. He said Tuesday that the city has extra staff monitoring the water system while automated operations are offline.
“We plan for these types of events, so we just had to physically go out to lift stations or the water towers, just to ensure they were functioning and running properly,” he said.
State officials did not say which other cities were targeted in the cyberattack.
Other local governments around the state have been targeted by cyberattacks in recent years, including the city of St. Paul in 2025 and Winona County earlier this year. Some school districts have also been affected.