A coordinated cyberattack targeted more than 30 community water systems across Minnesota on July 26 and 27, state technology officials said. Minnesota IT Services, or MNIT, disclosed the attack from St. Paul on Tuesday, July 28.
The agency said it activated Minnesota’s cybersecurity incident response capabilities as soon as it learned of the attack. It now works with federal, state, local, Tribal and private-sector partners.
So far, no drinking-water warning has gone out. Officials said they know of no active city request for residents to change their water use, and the Minnesota Department of Health is working directly with affected water systems.
What the attackers targeted
The attack hit operational technology, according to MNIT. That term covers computer systems that help run physical equipment at utilities.
The investigation remains active, officials said, and teams are still checking the cyber impact while helping utilities contain, investigate and fix the damage.
Cybersecurity firm Rescana published a technical review on Wednesday, July 29. It said the attackers went after computerized systems at water towers and lift stations that connect through cellular networks.
But those disruptions didn’t last long, Rescana said. The firm reported no water-quality impact, no service outages, no data theft and no ransom demand.
No suspect has been named. USA Today reported, citing officials, that authorities haven’t released details on how the attackers pulled it off.
Four cities went public
FOX 9 reported that four Minnesota cities publicly disclosed attacks on Monday: Plymouth, South St. Paul, Maple Plain and Braham.
All four cities said the impact stayed limited or was reduced, FOX 9 reported. They also told residents they could keep using water as normal.
MNIT’s July 28 statement didn’t name the affected communities. KTTC reported that the state release left out the specific towns hackers targeted.
State and federal teams respond
John Israel, MNIT’s assistant commissioner and Minnesota’s chief information security officer, described the response as a broad government effort.
“Cyberattacks against critical infrastructure require a coordinated, whole-of-government response,” Israel said.
Israel added that MNIT works with partners to share intelligence, support communities and help utilities restore operations safely. The response, he said, helped agencies contain the incident and prevent more serious impacts to critical services.
Teams are also sharing threat intelligence and indicators of compromise with affected organizations, and they’re monitoring for related malicious cyber activity alongside state and federal partners.
Rescana said that wider response includes the FBI, the Cybersecurity and Infrastructure Security Agency and the Environmental Protection Agency.
Why water utilities matter
Water systems count as critical infrastructure because communities depend on them every day. So even a short disruption can force local crews to switch quickly to backup plans.
Rescana said local officials used manual controls and backup procedures during the Minnesota attacks. Meanwhile, MNIT’s teams continue to support investigation, containment, recovery and remediation work.
The Minnesota Department of Health, for its part, is working directly with affected water systems to protect public health, MNIT said in its July 28 release.
Add Comment