A coordinated cyberattack targeted more than 30 community water systems across Minnesota on July 26 and 27, but the story did not stop at the Minnesota state line.
By Thursday, July 30, the FBI was warning that water and wastewater utilities in at least seven states had reported similar incidents. Some of those attacks did more than knock out a computer screen or inconvenience an office worker. According to the FBI, the attackers disrupted water operations, caused pressure loss, triggered flooding, locked operators out of equipment and forced utilities to run portions of their systems manually.
This is what years of warnings about America’s vulnerable water infrastructure actually look like when the warnings turn into a real attack.
The hackers were not simply stealing customer records or demanding money from a city computer network. They were targeting the operational technology that controls physical equipment: wells, pumps, valves, tanks and treatment systems. In at least one Minnesota community, the hackers shut down the controls operating the town’s well and water treatment plant, temporarily leaving the city dependent on whatever water remained inside its water tower.
Nobody has confirmed that drinking water was deliberately contaminated during these attacks. That distinction matters, and there is no reason to invent a contamination event that authorities say did not happen. But attackers gained malicious access to the machinery responsible for producing and moving drinking water. That should be alarming enough.
Attackers Went After the Machinery That Runs the Water System
Minnesota IT Services said the coordinated attack targeted operational technology at more than 30 community water systems on Sunday, July 26, and Monday, July 27.
Operational technology is the collection of computers and electronic controllers used to monitor and operate physical equipment. In a water facility, that can include pumps bringing water out of a well, valves directing water through the system, sensors measuring tank levels, chemical treatment equipment and the computerized screens workers use to control the entire process.
The state immediately activated its cybersecurity response operation and began working with the Minnesota Department of Health, the EPA, the FBI, the Cybersecurity and Infrastructure Security Agency and local utilities. Investigators found enough similarities in the timing and targeted equipment to describe the incidents as coordinated, although they have not said that every system was hit by the same attacker.
Most of the confirmed Minnesota attacks involved equipment used to remotely monitor and control water operations. Being listed as an affected community does not necessarily mean that every city lost water service, but investigators confirmed malicious activity inside the technology used to run those systems.
That is not a theoretical vulnerability. Someone reached into the systems controlling pieces of America’s drinking-water infrastructure and started changing things.
One Minnesota Town Was Left Relying on Its Water Tower
The small city of Braham, Minnesota, provides the clearest picture of what happened when the cyberattack crossed over into the physical world.
Braham, a town of roughly 1,700 people about 70 miles north of Minneapolis, asked residents to minimize water use for several hours on Monday while workers tried to determine why the municipal water plant had gone offline. City officials later said a cyberattack shut down the operating controls for the well and water treatment plant.
With the well and treatment controls down, the city was temporarily limited to the water already stored in its water tower. Officials said the incident did not affect water quality, and the system was restored before the town ran out.
Plymouth, a much larger city outside Minneapolis, also reported that communications with its water infrastructure were disrupted. Crews were able to continue running the system during the outage, and the city said water levels and water quality were not affected.
Those towns were fortunate. Operators retained enough manual capability, stored water and system knowledge to keep the situation under control. A different configuration, a longer outage or an attack launched when a tank was already low could have produced a much uglier result.
The FBI Says the Attacks Have Spread Across at Least Seven States
On July 30, the FBI and EPA issued a public warning saying water and wastewater utilities in at least seven states had reported attacks since July 27.
The attacks focused heavily on internet-connected programmable logic controllers, commonly called PLCs. These small industrial computers operate equipment inside factories, power systems, water plants and other critical infrastructure.
The FBI specifically identified Rockwell Automation and Allen-Bradley MicroLogix 1100 and 1400 controllers in the incidents it had observed. After remotely accessing the devices, attackers changed IP addresses and installed or changed passwords. That caused operators to lose the ability to monitor and, in some cases, control connected equipment.
At least one victim also discovered changes inside PLC project files, including discrepancies in the ladder logic used to tell industrial equipment what to do. The FBI said several affected utilities had similar network configurations supplied by third-party vendors, potentially allowing attackers to repeat the same intrusion against multiple customers using the same vulnerable setup.
That detail may explain how dozens of systems were hit within such a short period. Instead of individually hacking 30 completely different facilities, the attackers may have found a weakness repeated across systems installed or managed in the same way.
The FBI confirmed that operational effects included pressure loss and flooding. Loss of pressure is especially dangerous because it can allow untreated groundwater or other contamination to enter damaged or leaking water lines. Some affected utilities were forced to disconnect equipment, issue boil-water notices or maintain operations manually while systems were repaired.
This is the part people need to understand. A cyberattack against a water utility does not remain trapped inside a computer. When the computer controls pumps and valves, the cyberattack can shut down wells, empty tanks, flood facilities, reduce water pressure and interfere with treatment.
Iranian Hackers Are Suspected, but Attribution Has Not Been Confirmed
Minnesota officials and the FBI have not publicly named the attackers responsible for the July 26 and 27 incidents.
Several current and former U.S. cybersecurity officials reportedly believe the activity is likely connected to Iranian-affiliated hackers because the attacks resemble a campaign federal agencies had already been tracking. A federal advisory issued in April and updated on July 22 warned that Iranian-affiliated actors were targeting internet-facing industrial controllers used by water systems and other critical infrastructure.
The timing is difficult to ignore. Federal agencies expanded their warning only days before the Minnesota attacks, and the warning covered the same general category of industrial equipment. Iranian-linked groups also have a documented history of targeting water infrastructure, including the 2023 compromise of equipment at the Municipal Water Authority of Aliquippa, Pennsylvania.
But suspicion is not proof. Attackers can imitate another group’s tools, methods and public persona. Until the FBI or another responsible agency announces formal attribution, nobody can honestly claim that Iran has been conclusively identified as the attacker.
What can be said is that the operation matches the type of threat federal agencies have been warning about: foreign-affiliated actors scanning for poorly secured industrial controllers, breaking into them remotely and interfering with the physical systems attached to them.
America’s Small Water Utilities Are an Easy Target
The United States does not have one giant water system protected by one large security department. It has approximately 156,000 public water systems scattered across cities, towns, rural communities, schools, campgrounds, mobile-home developments and other facilities.
More than 97 percent of those systems serve 10,000 people or fewer. Many are run by a small staff responsible for everything from water testing and broken pipes to billing, maintenance and regulatory paperwork. They are expected to defend industrial control systems from foreign intelligence agencies and military-linked hacking groups while working with budgets that may barely cover routine repairs.
That is the absurd reality behind this threat.
A giant corporation can hire a round-the-clock cybersecurity team. A town of 1,700 people may have one or two employees who understand the water system, an outside technology contractor and a controller installed years ago because remote access made maintenance easier.
Some of these devices were connected directly to the public internet. Others were left with weak passwords, outdated software or remote-access settings that were convenient for contractors but convenient for attackers as well.
The FBI is now telling utilities to remove PLCs from direct internet exposure, use secure gateways and firewalls, replace weak passwords, restrict which computers can communicate with control equipment and preserve the ability to operate systems manually. Those are reasonable recommendations, but most of them should have been standard practice before attackers started shutting down wells.
The Government Has Known This Was Coming
The EPA warned in May 2024 that cyberattacks against community water systems were increasing in both frequency and severity. The agency said attackers could disrupt water treatment, distribution and storage, damage pumps and valves and potentially change treatment chemicals to hazardous levels.
That warning was issued more than two years before the Minnesota attacks.
Here at OFFGRID Survival, we have been raising the alarm about the vulnerability of public water infrastructure for even longer. Our original article, Infrastructure Threats to Our Drinking Water: What the Government Isn’t Telling You, was first published in 2013 and has since been updated to cover the growing threat from hackers, aging infrastructure and chemical contamination.
Earlier this year, we also published Water as a Weapon: Preparing for Threats to Our Drinking Water in Conflict, examining how water systems can become targets during international conflict, sabotage campaigns and attacks against domestic infrastructure.
The Minnesota attack does not prove that every worst-case scenario is about to happen. It does prove that hostile actors are actively reaching into the operational systems controlling American drinking water.
The attack surface is already there. The exposed equipment is already there. The foreign adversaries looking for it are already there.
What This Means for Your Water Preparedness
Most people have completely outsourced their water security to a pipe coming through the wall. They have no stored supply, no way to collect more and no plan for what happens when the local utility says the system is offline.
The residents of Braham were temporarily dependent on the amount of water sitting in a municipal tower. Had the outage lasted longer, the town could have faced a rapidly shrinking supply even though the aquifer beneath it still contained water. The problem was not a lack of water. The problem was losing control of the equipment needed to pump and treat it.
Your home has the same basic weakness. You may live near a river, reservoir or underground water supply, but none of that guarantees clean water will come out of your faucet after a cyberattack.
Store enough drinking water to get through more than a brief outage. One gallon per person per day is the usual emergency starting point, but that must cover drinking, cooking and limited hygiene. In hot climates, homes with children, medical needs or pets will require more. A two-week supply provides far more breathing room than the bare 72-hour minimum.
Pay attention to exactly what your water utility says during an incident. A boil-water advisory generally addresses possible biological contamination caused by pressure loss or treatment failure. Boiling can kill bacteria, viruses and parasites, but it does not remove fuel, pesticides, heavy metals or many industrial chemicals. In some cases, boiling chemically contaminated water can make the problem worse by evaporating water and concentrating what remains.
Do not assume that a camping filter, refrigerator filter or pitcher filter makes every contaminated source safe. Different filters remove different threats. Stored water is the fastest answer during the first stage of an outage because it does not require guessing what entered the municipal system or whether your filter can remove it.
Know where your local utility posts emergency information and sign up for municipal alerts before something happens. During an attack, official websites and billing systems may also be unavailable, so identify local radio stations, emergency-management channels and other ways to receive information.
Most importantly, stop treating municipal water as an unlimited resource that cannot fail. The pipes, pumps and treatment plants are physical systems controlled by people and machines. Those machines can break, lose power, be misconfigured or be deliberately attacked.
The Tap Is a Single Point of Failure
The Minnesota attacks were contained. Water quality was not reportedly compromised in the communities publicly identified, and operators restored affected systems before the situation became a major public-health emergency.
That is good news, but it is not proof that the system is safe.
More than 30 water systems in one state were targeted over two days. Within the same week, the FBI confirmed similar activity in at least seven states and acknowledged that some attacks degraded water operations. Hackers changed passwords, disrupted monitoring, caused pressure loss and flooding and forced utilities to fall back on manual controls.
This time, the safeguards mostly held.
The next attacker may be more capable. The next utility may not have enough water in its tower. The next town may discover that nobody remembers how to run the plant manually. The next incident could happen during a heat wave, wildfire, power outage or another emergency already straining the system.
Your water preparedness cannot begin after the pumps shut down. By then, every store in town will be selling the same last cases of bottled water to everyone who assumed the tap would always work.
Preparedness: Your Defense Against Water Threats
- Water Storage: FEMA and CDC still hammer home the baseline: at least one gallon per person per day for drinking and sanitation—aim for a two-week minimum (or more if space allows; some guides suggest bumping to 1.5 gallons in hot climates or high activity). Use food-grade containers, treat with bleach if needed for long-term storage, and rotate your stock every 6-12 months to keep it fresh. Fill bathtubs, sinks, and pots immediately if a crisis hits—your hot water heater alone can hold 40-50 gallons of usable emergency water (drain it via the bottom valve with a hose).
- Filtration and Purification: Don’t rely on boiling alone—it kills bacteria and parasites but leaves chemicals, heavy metals, and “forever chemicals” like PFAS behind. Invest in robust gravity-fed systems that tackle biologics, chemicals, and more. Berkey-style filters remain popular for off-grid use, but with recent regulatory scrutiny and much better alternatives, check out systems like Boroux Foundation, Alexapure Pro,or ProOne. Combine with UV purifiers for extra biological kill power, or distillation setups for the toughest contaminants. Portable filters like Katadyn Pocket are great for bug-out bags.
- Alternative Sources: Diversify beyond the tap. Set up rainwater catchment with barrels or tanks—simple gutters and food-grade containers can harvest hundreds of gallons during storms. If you’re in a position to drill a shallow well, do it. Coastal folks: look into portable desalination kits (hand-pumped or compact units like QuenchSea or emergency marine desalinator packs) for turning seawater usable in a pinch. Scout and map local natural sources—ponds, streams, rivers—note distances, risks, and access. In urban areas, carry a multi-tool and water spigot key to discreetly access commercial faucets (handles often removed to deter misuse—only for true emergencies, and be smart about it). For more on urban resupply tactics, including plotting routes, finding hidden sources, and escape planning, check out my older piece: Urban Resources: Finding Food & Water During a Long-term Disaster.
- Home Security: Water storage and systems are tempting targets—secure tanks, pipes, and access points against tampering or theft. For off-grid setups, build in redundancies: multiple filters, backup storage, solar-powered pumps if possible. Fortify your property with basic perimeter measures and early-warning tools.
- Prepper Communities and Monitoring: Prep isn’t solo—link up with local groups, neighbors, or mutual aid networks for shared resources and intel. Download the FEMA App for real-time weather alerts, emergency tips, shelter locations, and disaster updates—it pulls National Weather Service data and can notify you of water-related threats..
Read the full article here
