A coordinated cyberattack has targeted more than 30 community water systems across Minnesota, including in Twin Cities suburbs Plymouth and South St. Paul.

Sunday night and early Monday morning, city officials across the state discovered outages and disruptions to some of their water utilities’ automated operating controls.

City officials from the affected communities said there was no impact to water quality. Drinking water remains safe, and water and wastewater services are fully operational. Officials say there is no indication that customer data were accessed or compromised.

In Braham, City Administrator Kevin Stahl said unknown actors used malicious malware to shut down operating controls, hacking a wireless connection to the city’s water plant. The city was then unable to fill its water tower, so the town about an hour north of the Twin Cities was temporarily left with what was already stored.

Stahl said the system was back online after about an hour and a half, and that officials have now removed that vulnerability and are investigating further.

Cyberattacks against municipal water systems are increasing as day-to-day operations of the utilities become more dependent on digital connectivity, according to the U.S. Environmental Protection Agency. Experts say the systems can be vulnerable with outdated infrastructure, and are sometimes targeted because disruptions create fast and visible impacts.

Federal officials have warned of cyberattacks by adversarial nation states, including Iranian-affiliated actors, on U.S. infrastructure, including on small town water utilities. Other cities in recent years have faced cyberattacks by hackers demanding ransom or testing security.

Emily Zimmer, a spokesperson for Minnesota IT services, said in an email on Tuesday: “At this time, there has been no ransom demand associated with this incident. The activity appears consistent with a broader campaign targeting similar types of facilities across the country.”

Plymouth Public Works Director Michael Thompson said remote communications between two of the city’s water towers and multiple lift stations went offline. The city is now operating the system manually.

South St. Paul also has switched to manual operations while its automated controls are restored.

“The City continues to work closely with its technology partners and government agencies to restore automated operations and evaluate additional measures to strengthen system security,” South St. Paul spokesperson Jacob Steiner said in an email.

In Maple Plain, Mayor Julie Maas-Kusske declared a local state of emergency so the city can coordinate resources and expedite its response, officials said in a news release. Crews implemented contingency procedures to keep the city’s water and wastewater operations going.

State and local officials on Tuesday did not provide many other specifics on the attack, including why or how certain communities’ systems were targeted.

Zimmer said she could not provide a list of the affected communities, but noted the attacks happened across the state.

“Cyberattacks against critical infrastructure require a coordinated, whole-of-government response,” John Israel, assistant commissioner of Minnesota IT Services assistant commissioner and the state’s chief information security officer, said in a news release.

State and federal agencies, including the Cybersecurity and Infrastructure Security Agency, U.S. Environmental Protection Agency, and Federal Bureau of Investigation, are investigating the cyberattack. Minnesota IT Services and the Minnesota Department of Health are working with affected communities to continue assessing their water systems.

“Our response worked as intended, enabling agencies at every level of government to rapidly coordinate, contain the incident, and help prevent more serious impacts to critical services,” Israel said.

_____

©2026 The Minnesota Star Tribune. Visit startribune.com. Distributed by Tribune Content Agency, LLC