--- title: A coordinated attack hit 30+ Minnesota water systems.... description: A coordinated cyberattack struck more than 30 Minnesota community water systems over July 26–27, marking what experts call the first distributed campaign... canonical: https://daily.dev/posts/a-coordinated-attack-hit-30-minnesota-water-systems-who-did-it-and-what-does-a-rockwell-notice-ad-k1yrtrafy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: A coordinated attack hit 30+ Minnesota water systems. Who did it, and what does a Rockwell notice add to the picture? | daily.dev og:description: A coordinated cyberattack struck more than 30 Minnesota community water systems over July 26–27, marking what experts call the first distributed campaign... og:url: https://daily.dev/posts/a-coordinated-attack-hit-30-minnesota-water-systems-who-did-it-and-what-does-a-rockwell-notice-ad-k1yrtrafy og:image: https://api.daily.dev/og/posts/K1YRTrAfY.png og:image:alt: A coordinated attack hit 30+ Minnesota water systems. Who did it, and what does a Rockwell notice add to the picture? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A coordinated attack hit 30+ Minnesota water systems. Who did it, and what does a Rockwell notice add to the picture? **[CSO Online](https://daily.dev/sources/csoonline)** · 8 min read · 1 upvotes · 0 comments ## Summary A coordinated cyberattack struck more than 30 Minnesota community water systems over July 26–27, marking what experts call the first distributed campaign targeting dozens of small utilities through a shared operational technology weakness. The city of Braham suffered the most visible impact, shutting down portions of its water system for roughly two hours. Investigators are examining whether vulnerable Rockwell Automation MicroLogix 1400 PLCs served as a common entry point, coinciding with a Rockwell security advisory issued July 30. Iranian-affiliated actors are the leading suspects, though no group has publicly claimed responsibility — an unusual silence compared to previous campaigns by groups like CyberAv3ngers and Handala. CISA has issued fresh guidance urging water utilities to remove internet-exposed PLCs immediately. Experts stress that attackers rarely need zero-day exploits; weak credentials and internet-exposed industrial controllers remain the primary enablers. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What caused the cyberattack on Minnesota water systems in July 2026? Investigators are examining whether vulnerable Rockwell Automation MicroLogix 1400 programmable logic controllers, some publicly exposed to the internet via cellular connections, provided a common entry point across more than 30 affected utilities. A Rockwell Automation security advisory addressing the MicroLogix 1400 family was issued the same day CISA urged utilities to remove exposed PLCs from the internet, though causation has not been confirmed. _Teams securing water sector OT infrastructure follow PLC vulnerability disclosures like this one on daily.dev._ ### Who was behind the coordinated attack on Minnesota water utilities? No group has been officially confirmed responsible. Most experts suspect Iranian-affiliated actors given recent federal warnings about Iran targeting operational technology in water systems, but neither Handala nor CyberAv3ngers publicly claimed credit as they typically do, and an Iranian state publication only attributed the attack to Handala two days later, an unusual delay attributed to a deliberate strategy of strategic ambiguity. _Security teams tracking attribution in critical infrastructure attacks follow developing threat intelligence on daily.dev._ ### What impact did the Minnesota water utility cyberattack have on operations? Impact was limited: the city of Braham shut down portions of its water system for roughly two hours while operators regained control, Plymouth disconnected cellular-connected equipment at two water towers and multiple wastewater lift stations, and South St. Paul reported some automated controls were affected. No boil-water orders were issued and drinking water remained safe throughout the incident. _Utilities assessing OT incident response plans reference real-world outcomes like this on daily.dev._ ## Similar posts on daily.dev - [Critical infrastructure’s long, undefended tail exposed by UK energy attack](https://daily.dev/posts/critical-infrastructure-s-long-undefended-tail-exposed-by-uk-energy-attack-hajfwhwyk) · CSO Online · 0 upvotes · 0 comments - [What we know about the alleged Iranian hacks on US water utilities](https://daily.dev/posts/what-we-know-about-the-alleged-iranian-hacks-on-us-water-utilities-ppbezomds) · TechCrunch · 21 upvotes · 3 comments --- [View this post on daily.dev](https://daily.dev/posts/a-coordinated-attack-hit-30-minnesota-water-systems-who-did-it-and-what-does-a-rockwell-notice-ad-k1yrtrafy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"A coordinated attack hit 30+ Minnesota water systems. Who did it, and what does a Rockwell notice add to the picture?","url":"https://daily.dev/posts/a-coordinated-attack-hit-30-minnesota-water-systems-who-did-it-and-what-does-a-rockwell-notice-ad-k1yrtrafy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/a-coordinated-attack-hit-30-minnesota-water-systems-who-did-it-and-what-does-a-rockwell-notice-ad-k1yrtrafy"},"datePublished":"2026-07-30T21:55:41.970Z","dateModified":"2026-09-14T07:40:39.552Z","description":"A coordinated cyberattack struck more than 30 Minnesota community water systems over July 26–27, marking what experts call the first distributed campaign...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/34441830947ef916b51e529da85c07fb?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/34441830947ef916b51e529da85c07fb?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/a-coordinated-attack-hit-30-minnesota-water-systems-who-did-it-and-what-does-a-rockwell-notice-ad-k1yrtrafy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"A coordinated attack hit 30+ Minnesota water systems. Who did it, and what does a Rockwell notice add to the picture?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/a-coordinated-attack-hit-30-minnesota-water-systems-who-did-it-and-what-does-a-rockwell-notice-ad-k1yrtrafy#faq","mainEntity":[{"@type":"Question","name":"What caused the cyberattack on Minnesota water systems in July 2026?","acceptedAnswer":{"@type":"Answer","text":"Investigators are examining whether vulnerable Rockwell Automation MicroLogix 1400 programmable logic controllers, some publicly exposed to the internet via cellular connections, provided a common entry point across more than 30 affected utilities. A Rockwell Automation security advisory addressing the MicroLogix 1400 family was issued the same day CISA urged utilities to remove exposed PLCs from the internet, though causation has not been confirmed. Teams securing water sector OT infrastructure follow PLC vulnerability disclosures like this one on daily.dev."}},{"@type":"Question","name":"Who was behind the coordinated attack on Minnesota water utilities?","acceptedAnswer":{"@type":"Answer","text":"No group has been officially confirmed responsible. Most experts suspect Iranian-affiliated actors given recent federal warnings about Iran targeting operational technology in water systems, but neither Handala nor CyberAv3ngers publicly claimed credit as they typically do, and an Iranian state publication only attributed the attack to Handala two days later, an unusual delay attributed to a deliberate strategy of strategic ambiguity. Security teams tracking attribution in critical infrastructure attacks follow developing threat intelligence on daily.dev."}},{"@type":"Question","name":"What impact did the Minnesota water utility cyberattack have on operations?","acceptedAnswer":{"@type":"Answer","text":"Impact was limited: the city of Braham shut down portions of its water system for roughly two hours while operators regained control, Plymouth disconnected cellular-connected equipment at two water towers and multiple wastewater lift stations, and South St. Paul reported some automated controls were affected. No boil-water orders were issued and drinking water remained safe throughout the incident. Utilities assessing OT incident response plans reference real-world outcomes like this on daily.dev."}}]} ```