The Incident: A Coordinated Attack on Critical Infrastructure
On Sunday, July 26, 2026, and continuing into Monday, July 27, dozens of municipal water systems across the United States came under coordinated cyberattack. Minnesota was hit hardest—more than 30 water systems in the state were targeted—but investigators have confirmed that similar attacks occurred in at least six other states, including Wisconsin and systems in the Eastern U.S.
U.S. intelligence agencies, the FBI, and state officials now assess that Iran was likely responsible for the attack, though they have cautioned that this assessment is preliminary and could change as additional technical evidence is collected. The timing of the attack—coming during an escalating military conflict between the U.S. and Iran—raised immediate concerns about state-sponsored cyber warfare against American critical infrastructure.
The attack forced water systems across multiple states to implement emergency workarounds, disconnecting compromised equipment and switching to manual operations to maintain service. However, importantly, there were no reports of water contamination, and no municipal water supplies were rendered unsafe to drink during the incident.
Technical Details: Targeting the Weakest Link
What the Attackers Targeted
The hackers focused on programmable logic controllers (PLCs)—devices that automatically monitor and control critical water system operations including water pressure, chemical dosing, pump operations, and equipment alarms. These PLCs are installed at water towers, treatment plants, and pumping stations to allow remote monitoring and control of water infrastructure.
In many cases, the PLCs were connected directly to the internet or accessible via cellular modems installed by vendors or system integrators. This internet connectivity, installed for operational convenience, became a critical vulnerability.
The Attack Method: Simple but Devastating
The cyberattack was not technically sophisticated. According to federal investigators, the hackers exploited publicly exposed PLCs that still retained their default passwords—credentials that had never been changed from the factory settings.
Once inside, the attackers attempted to change system passwords, locking out legitimate operators and disrupting remote monitoring and control capabilities. In some cases, the attack caused loss of system pressure—a condition that could potentially lead to water contamination if not detected and corrected quickly.
John Israel, Minnesota's chief information security officer, explained the scale of the problem: "The hackers are targeting water entities of all sizes. They're 'rattling doorknobs'—testing systems for weak configurations and default credentials. And when they find one, they exploit it."
How It Was Detected and Contained
Minnesota was one of the first states to detect the attack, with public works personnel in Braham noticing that the well supplying the city's water tower was malfunctioning early Monday morning. Within approximately 90 minutes, public works isolated the affected system, restored a backup, and restarted the plant.
In Plymouth, Minnesota, operators discovered compromised PLCs at two water towers and 14 sewer lift stations after noticing interrupted communication between devices on Sunday evening. They immediately disconnected the systems from cellular networks and switched to manual operation mode.
In South St. Paul, public works employees transitioned to manual operations as soon as the attack was detected, allowing water and wastewater services to continue without interruption.
Why This Matters: Vulnerability of American Water Infrastructure
A Preview of a Larger Problem
The United States operates 152,000 public drinking water systems and more than 16,000 wastewater treatment systems. According to cybersecurity experts and federal agencies, the vast majority of these systems are old, underfunded, and lacking fundamental cybersecurity controls.
Many water utilities operate with limited staff and aging technology. As Nate George, mayor of Braham, Minnesota, stated: "Minnesota's local governments are expected to defend essential systems against foreign adversaries and sophisticated criminals, often with limited staff, aging technology and inadequate resources."
Water Systems Have Been a Target for Months
This is not the first time Iran has targeted American water infrastructure. In April 2023, a group affiliated with Iran's Islamic Revolutionary Guard Corps successfully hacked a municipal water pumping station in Aliquippa, Pennsylvania. The group, known as CyberAv3ngers, targeted programmable logic controllers made by an Israeli firm called Unitronics across multiple countries.
More recently, federal cybersecurity authorities issued warnings in April and July 2026 alerting water systems that Iranian-affiliated cyberactors were actively targeting internet-connected operational technology devices. The Minnesota attacks came just days after CISA updated one of these warnings.
Joe Slowik, director of threat research for Dataminr, noted: "It is not a secret that these things have been taking place since the spring. There have been disruptions in multiple critical infrastructure sectors. It's a big deal."
Low-Hanging Fruit: Why Water Systems Are Easy Targets
The fundamental problem is simple: internet-exposed programmable logic controllers with default passwords are trivial targets for attackers.
Kurt Gaudette, head of intelligence for Dragos, a cybersecurity firm specializing in critical infrastructure protection, explained: "The targeting of small utilities that use internet-exposed controllers with default passwords—it's very low-hanging fruit."
Water systems have adopted remote access to improve operational efficiency. But without changing default credentials and disconnecting non-essential equipment from the internet, that convenience becomes a liability.
What Iran's Goal Appears to Be
According to security experts, Iran's cyberattacks appear to be less focused on outright destruction than on psychological effects. The goal is twofold:
- Against the American public: To create fear and undermine confidence in critical infrastructure, generating domestic pressure against continued military engagement
- For the Iranian regime: To demonstrate capability and contribution to the war effort, showing internal audiences that Iran can strike back against the U.S.
Alex Orleans, head of threat intelligence at Sublime Security, noted: "They want to show their bosses that they're contributing to the war effort. It's less about causing maximum damage than about delivering a message."
Broader Implications: A Cascading Risk
The Paradox of Connectivity
Water systems gained significant operational benefits from remote monitoring and control: faster response times, reduced staffing needs, better asset management, and improved efficiency. But now they face the inverse problem: those same connections that enable improvement also enable attack.
Joshua Corman, an industrial cybersecurity expert and co-founder of I am the Cavalry, posed a critical question: "Water systems have enjoyed the benefits of remote access, but now those who wish us harm have it, too. With great connectivity comes great responsibility. We should be asking ourselves: if we can't protect it, should we disconnect it?"
The Cascading Dependencies of Critical Infrastructure
Water systems are foundational to modern society. No water means hospitals can't operate, emergency services fail, and public health collapses. Corman warned: "So much depends upon water. No water, no hospital, no kidding. In 2-4 hours, you have a cascading infrastructure failure."
When water systems are compromised—even temporarily—the ripple effects cascade across healthcare, emergency services, commercial operations, and public safety.
The Scale of the Problem
Gus Serino, a longtime cybersecurity specialist focused on the water sector, assessed the Minnesota attacks as unprecedented: "The scale and coordination of the recent cyberattacks targeting Minnesota water suppliers is unprecedented. While the inherent resilience of the water sector helped limit operational impacts, these incidents once again demonstrate that many drinking water utilities continue to rely on technology architectures that lack fundamental cybersecurity controls."
Geopolitical Tensions and Attribution Challenges
While U.S. investigators assess that Iran was likely responsible, they have cautioned that attribution is not certain. There is also the possibility—though assessed as unlikely by former intelligence officials—that the attackers could be deliberately posing as Iranian to escalate tensions between the U.S. and Iran during an already volatile period.
President Trump weighed in publicly, casting doubt on the Iran attribution: "They like to say, 'Oh, it was Iran.' Iran should be so lucky. Iran's got bigger problems than worrying about Minnesota."
What Water Utilities Must Do Now
CISA's Emergency Recommendations
The federal Cybersecurity and Infrastructure Security Agency (CISA) issued urgent guidance after the Minnesota attacks. Water and wastewater utilities must:
- Remove publicly exposed PLCs and operational technology from the internet immediately — if a device doesn't need to be internet-connected, disconnect it now
- Change all default passwords — default credentials are the easiest entry point for attackers
- Validate external connections — including cellular modems installed by vendors that may not be documented
- Implement network segmentation — isolate critical operational technology from corporate networks and the internet
- Enable monitoring and alerting — detect unauthorized changes to PLCs and control systems
For Water System Operators
Local water systems should have alternative procedures ready to switch to manual operation on short notice. This requires trained staff, documented procedures, and regular drills to ensure continuity of service if remote systems are compromised.
Water utilities should also share threat intelligence with peers and federal authorities. Minnesota's early detection helped other states prepare for similar attacks.
For Policymakers and Funding Bodies
Decades of underfunding and deferred maintenance have left American water systems vulnerable. Meaningful security improvements require investment: replacing aging equipment, modernizing infrastructure, hiring trained cybersecurity staff, and funding regular security audits and penetration testing.
Key Takeaways
- A coordinated cyberattack hit 30+ municipal water systems in Minnesota and similar systems in at least six other states on July 26-27, 2026
- U.S. intelligence agencies assess that Iran was likely responsible, though attribution is preliminary and could change
- The attack exploited internet-exposed programmable logic controllers (PLCs) with default passwords—a trivially easy target
- No water contamination or loss of supply occurred; operators switched to manual mode and restored service within hours
- This attack highlights the vulnerability of American water infrastructure, which operates with limited funding, aging technology, and underfunded cybersecurity teams
- Iran has a demonstrated pattern of targeting U.S. water systems as part of its cyber warfare campaign
- Water utilities must immediately disconnect internet-exposed operational technology, change default passwords, and implement network segmentation
- The incident underscores the cascading risks when foundational infrastructure is compromised—water system failure triggers failures across healthcare, emergency services, and public safety
- Meaningful security requires sustained investment in infrastructure modernization, staff training, and cybersecurity capabilities