--- title: Hackers hit 30+ Minnesota water systems in coordinated... description: A coordinated cyberattack hit over 30 Minnesota community water systems on July 26–27, disabling Rockwell Automation MicroLogix 1400 PLCs and forcing several... canonical: https://daily.dev/posts/hackers-hit-30-minnesota-water-systems-in-coordinated-attack-cisa-warns-of-wider-threat-8sa0gotle twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hackers hit 30+ Minnesota water systems in coordinated attack, CISA warns of wider threat | daily.dev og:description: A coordinated cyberattack hit over 30 Minnesota community water systems on July 26–27, disabling Rockwell Automation MicroLogix 1400 PLCs and forcing several... og:url: https://daily.dev/posts/hackers-hit-30-minnesota-water-systems-in-coordinated-attack-cisa-warns-of-wider-threat-8sa0gotle og:image: https://api.daily.dev/og/posts/8sA0Gotle.png og:image:alt: Hackers hit 30+ Minnesota water systems in coordinated attack, CISA warns of wider threat og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hackers hit 30+ Minnesota water systems in coordinated attack, CISA warns of wider threat **[Collections](https://daily.dev/sources/collections)** · 4 min read · 4 upvotes · 1 comments ## Summary A coordinated cyberattack hit over 30 Minnesota community water systems on July 26–27, disabling Rockwell Automation MicroLogix 1400 PLCs and forcing several municipalities into manual operations. Iranian-affiliated group CyberAv3ngers is the leading suspect, though no group has claimed responsibility. Attackers exploited basic security failures: default passwords, internet-exposed PLCs, poor IT/OT network segmentation, and a critical 2021 authentication-bypass vulnerability (CVSS 9.8). CISA issued an advisory flagging hardware from Rockwell, Schneider Electric, Siemens, and Unitronics. The attack is notable as the first distributed campaign targeting dozens of small utilities through a shared OT weakness. Over 70% of US water systems were already out of compliance with basic risk assessment requirements, and the scale of simultaneous impact across 30+ systems signals the potential for even larger future campaigns. ## Content ## What happened Over the weekend of July 26–27, a coordinated cyberattack knocked out programmable logic controllers (PLCs) at more than 30 community water systems across Minnesota. Four municipalities — Plymouth, South St. Paul, Maple Plain, and Braham — confirmed disruptions. Braham had it worst, shutting down portions of its water system for roughly two hours. Most affected utilities were forced into manual operations for about 90 minutes before regaining control. CISA followed up with an urgent advisory warning that attacks on internet-exposed industrial control systems are increasing, and that water and wastewater infrastructure is a primary target. ## How the attackers got in No group has publicly claimed responsibility, which is unusual — previous campaigns by Iranian-affiliated actors like CyberAv3ngers and Handala typically came with announcements. Investigators are looking at whether Rockwell Automation MicroLogix 1400 PLCs served as a common entry point across the affected utilities. Rockwell issued a security advisory on July 30, the same week as the attack. The tactics weren't sophisticated. Attackers changed PLC passwords to lock out operators, modified IP addresses, and caused operational disruptions. They didn't need zero-day exploits. The primary enablers were: - Default or weak passwords left unchanged - PLCs directly exposed to the public internet - Poor segmentation between IT and OT networks - An unpatched 2021 authentication-bypass vulnerability in Rockwell hardware (CVSS 9.8) CISA's advisory named vulnerable hardware from Rockwell, Schneider Electric, Siemens, and Unitronics. Cybersecurity firm Censys estimates over 4,100 internet-exposed Rockwell/Allen-Bradley hosts are reachable online, with similar numbers for Siemens and Schneider Electric. Nearly half of exposed Rockwell devices are reachable through consumer ISPs and cellular networks — often through undocumented cellular modems that don't show up in standard network scans. ## The backup problem nobody's talking about There's a detail that deserves more attention: attackers may have exfiltrated PLC project files during the intrusion. If true, some utilities are now in the uncomfortable position of having worse backups of their own control logic than the people who attacked them. This isn't hypothetical. Small water utilities often lack current backups of their control programming. If a PLC gets wiped or corrupted, recovery depends on documentation that may be years out of date — or stored only in the memory of a systems integrator who also serves dozens of other customers. That shared-integrator relationship is its own risk. A single compromised vendor can become a single point of failure across an entire fleet of utilities. ## The broader context The US has up to 170,000 water systems, most of them small and under-resourced. Over 70% were already failing to comply with a 2018 risk-assessment law before this attack. Many run on aging hardware with remote access bolted on as an afterthought — often a cellular modem added by a contractor that never made it onto any asset inventory. Cellular-connected OT devices are particularly hard to find. They don't respond to network scans. The only reliable way to audit them is to pull carrier invoices and reconcile every SIM card to a physical asset. ## What CISA is recommending CISA's guidance is practical and immediate: - Remove PLCs and other OT devices from direct internet exposure - If removal isn't possible, put them behind a VPN or gateway device - Change all default passwords now - Restrict remote access via IP allowlists - Enable MFA for any remote access that remains - Segment IT and OT networks - Patch the 2021 Rockwell authentication-bypass vulnerability if you haven't ## A response timeline for OT operators Beyond CISA's immediate steps, a tiered response makes sense: **Within 72 hours:** Eliminate public IPs on control devices. Audit cellular connections against carrier invoices. Verify you have a current backup of all PLC project files. **Within 30 days:** Rotate all vendor and operator credentials. Replace standing remote-access tunnels with just-in-time access. Document manual operation procedures on paper. **Within one quarter:** Drill manual operations with actual staff. Don't assume operators know what to do when the SCADA screen goes dark — test it. That last point matters more than it sounds. Manual operation capability has to be pre-planned and practiced. Discovering mid-incident that nobody knows how to run the plant by hand is a bad time to find out. ## Community discussion Top comments from developers on daily.dev. **@h3l0st3k** · 0 upvotes > This is a good example of why OT security requires a different mindset from traditional IT security. > > Many industrial systems were designed for reliability and availability, not internet exposure. Once PLCs become connected, basic practices like segmentation, asset inventory, access control, and secure remote access become critical. --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/hackers-hit-30-minnesota-water-systems-in-coordinated-attack-cisa-warns-of-wider-threat-8sa0gotle) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hackers hit 30+ Minnesota water systems in coordinated attack, CISA warns of wider threat","url":"https://daily.dev/posts/hackers-hit-30-minnesota-water-systems-in-coordinated-attack-cisa-warns-of-wider-threat-8sa0gotle","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hackers-hit-30-minnesota-water-systems-in-coordinated-attack-cisa-warns-of-wider-threat-8sa0gotle"},"datePublished":"2026-07-31T09:23:29.872Z","dateModified":"2026-08-04T09:07:29.851Z","description":"A coordinated cyberattack hit over 30 Minnesota community water systems on July 26–27, disabling Rockwell Automation MicroLogix 1400 PLCs and forcing several...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/11c9eb627b2a4dc33b6fe70d7d836ce0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/11c9eb627b2a4dc33b6fe70d7d836ce0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/hackers-hit-30-minnesota-water-systems-in-coordinated-attack-cisa-warns-of-wider-threat-8sa0gotle","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Hackers hit 30+ Minnesota water systems in coordinated attack, CISA warns of wider threat"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/hackers-hit-30-minnesota-water-systems-in-coordinated-attack-cisa-warns-of-wider-threat-8sa0gotle","comment":[{"@type":"Comment","text":"This is a good example of why OT security requires a different mindset from traditional IT security.\nMany industrial systems were designed for reliability and availability, not internet exposure. Once PLCs become connected, basic practices like segmentation, asset inventory, access control, and secure remote access become critical.","datePublished":"2026-08-03T12:25:01.376Z","url":"https://daily.dev/posts/8sA0Gotle#c-6xCZJnFKH","author":{"@type":"Person","name":"H3l!0s_T3k","url":"https://daily.dev/h3l0st3k","image":"https://avatars.githubusercontent.com/u/90980178?v=4"}}]} ```