Cyber Attack Hits Minnesota’s Water Systems

This week, over 30 community water systems in Minnesota faced a cyber attack. This incident led some utilities to operate manually while authorities, both state and federal, investigated the responsible parties.

Authorities are exploring whether Iranian hackers were involved. They note the possibility of someone trying to mimic Iran’s involvement due to the ongoing U.S. conflict with Iran. However, they have not officially blamed any specific group yet. Most affected systems relied on technology, such as programmable logic controllers, for remote monitoring and control.

Mike Ernster, from the Minnesota Department of Public Safety, confirmed that the water supply remains safe. The Minnesota Fusion Center and other partners are addressing the issue with local and federal help.

Nick Anderson, acting director of the Cybersecurity and Infrastructure Security Administration (CISA), noted an increase in cyber threats targeting programmable logic controllers (PLCs) at water utilities. Anderson urged infrastructure operators to promptly disconnect exposed PLCs and other technologies from the internet.

Recent incidents shared similar timing and technological targets, though not all incidents were confirmed to be linked to the same actor.

In South St. Paul, a cyber issue was detected early Monday. The city activated contingency plans, transitioning to manual operations to maintain water services without disruption. Officials confirmed resident and customer data remained secure.

In Braham, an issue arose when the well supplying the city’s water tower malfunctioned. Public works isolated the affected system and restored a backup within 90 minutes, ensuring continuous water service. Mayor Nate George reported no interruptions for residents.

The FBI is aware of the situation and remains in contact with affected communities. CISA reported a rise in threats against PLCs across the water and wastewater sector, urging operators to review and secure their systems’ external connections.

Historically, Iran-affiliated hackers have targeted U.S. utilities. In 2023, such groups exploited controllers with default passwords at multiple facilities. This ongoing threat underscores the need for rigorous cybersecurity measures across critical infrastructure systems.