Cybersecurity & Digital ThreatsEvent: 26 July 2026Published: 18 October 2026· By ARMSMA

Hackers locked operators out of water plants in at least seven US states — why were the controls reachable at all?

At about 9:30 on the morning of Monday 27 July 2026, the small Minnesota city of Braham announced that its water treatment plant was offline "for an unknown reason". Residents were asked to limit water use, because the supply left in the water tower was limited, MPR News reported.

Later that day the city gave the reason. The outage "was a result of a malicious cyberattack of computerized operating systems by unknown actors". The attackers had shut down the operating controls, which shut down the well and the treatment plant.

Braham was not alone. Within days, the FBI and the Environmental Protection Agency (EPA) said water systems in at least seven states had been hit. No hacker needed to break anything new: the controllers were reachable from the internet. That makes this a story about the thousands of small utilities that run on the same kind of equipment.

What did the attackers do?

According to the FBI and EPA, the attackers remotely accessed internet-facing devices, changed IP addresses and passwords, and caused utilities to lose monitoring and control, NBC News reported. The FBI warning named internet-facing Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers, according to an analysis by LevelBlue SpiderLabs.

LevelBlue found no new software flaw behind the campaign. It relied on internet exposure, weak or absent authentication, insecure cellular modems, misconfigured remote access and legitimate engineering tools. At least one utility found modified project files, and the FBI noted that several victims shared common third-party network configurations, which may let the same method be reused.

How many systems were hit?

Minnesota: at least 30 municipal water facilities targeted on 26–27 July, according to Minnesota IT Services as reported by TIME; NBC News and LevelBlue say more than 30. Only Braham, Plymouth, South St. Paul and Maple Plain were named publicly.
Michigan: nine water systems, according to TIME.
Nationally: incidents in at least seven states, according to the FBI and EPA, which did not name them, NBC News reported.

Was anyone's water unsafe?

State officials said the attacks mainly interrupted service and did not expose drinking water to contamination, TIME reported. Braham said its water was "filtered and treated as expected", and Michigan's environment department said "all systems continued to operate safely".

The effects were still real. Plymouth lost communications to two water towers and several lift stations and switched to manual procedures, according to MPR News. Across the wider campaign, LevelBlue lists loss of pressure, flooding, communication outages, boil-water notices and extended manual operation. The FBI and EPA warned that disruptions such as pressure loss "could potentially allow untreated ground water to seep into pipes".

Not every account agrees. A bulletin from Wisconsin's environment agency said Minnesota had reported hackers lowering system pressures. A Minnesota IT spokesperson, Emily Zimmer, disputed this: "Minnesota has not reported that threat actors lowered pressure across multiple water systems," she told NBC News.

Who is behind it?

Nobody has been formally named. On 22 July, days before the attacks, federal agencies updated a warning about Iranian-affiliated cyber activity against US critical infrastructure, TIME reported. The attacks resemble a 2023 incident at a Pittsburgh water facility that the cybersecurity agency CISA attributed to CyberAv3ngers, a group affiliated with Iran's Islamic Revolutionary Guard Corps.

A law enforcement official told NBC News the Minnesota attack had hallmarks of Iranian meddling. But neither Minnesota nor the US government has publicly attributed it. "Attribution requires careful analysis of technical evidence," Zimmer said. LevelBlue describes the activity as unattributed, with "technical and contextual similarities" to the Iranian campaign, and calls Iranian involvement a working hypothesis.

The question quickly became political. President Trump dismissed Iranian involvement without offering evidence and blamed Minnesota, according to TIME: "I think I blame it on Minnesota because they're grossly incompetent," he said. Governor Tim Walz blamed cuts to CISA and suggested Iran could be retaliating for US strikes: "Trump knows exactly who is responsible for this attack, and knows that other states were hit too."

Whose job is it to close the gap?

The EPA has previously warned that many local water systems have serious weaknesses, including outdated software and weak access controls. EPA Administrator Lee Zeldin said there is "a lot of individual responsibility" on utilities and local governments, TIME reported. CISA recommended extra password protections and disconnecting key systems from the internet.

LevelBlue's checklist for operators is longer: remove direct internet exposure of controllers and modems, change default and shared credentials, enforce multi-factor authentication for remote access, check running logic against known-good copies, and keep the ability to run essential equipment by hand.

What we do not know

Who carried out the attacks. As of the sources we opened (early August 2026), no formal attribution had been made.
Which other states were affected, and how badly. The FBI and EPA did not name them, and only four of Minnesota's affected systems were named publicly.
Whether any water was actually compromised anywhere. Officials in Minnesota and Michigan said no; the national picture is not public.

What to watch

Federal agencies said they were still investigating, and the FBI said it was committed to identifying and disrupting those responsible. For utilities, the lesson does not depend on who did it: a controller that can be reached from the internet can be reached by anyone. The test is how many of them are still exposed when the next warning comes.

Sources

Cybersecurity & Digital Threats18 Oct 2026

Hackers pushed supermarket fridges to 50 °C — how did old controllers put France's food shelves at risk?

On the night of 11–12 October 2026 attackers remotely forced Danfoss refrigeration controllers in hundreds of French supermarkets into defrost, pushing temperatures as high as 50 °C. Shops threw out fresh and frozen food; the Paris prosecutor is investigating, and no one has claimed the attack.