--- title: Minnesota Water Cyber Attack and CISA Advisory AA26-097A description: A coordinated cyberattack disrupted water and wastewater systems across 30+ Minnesota communities on July 26-27, 2026, affecting cities including Braham,... canonical: https://daily.dev/posts/minnesota-water-cyber-attack-and-cisa-advisory-aa26-097a-ngernk13k twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Minnesota Water Cyber Attack and CISA Advisory AA26-097A | daily.dev og:description: A coordinated cyberattack disrupted water and wastewater systems across 30+ Minnesota communities on July 26-27, 2026, affecting cities including Braham,... og:url: https://daily.dev/posts/minnesota-water-cyber-attack-and-cisa-advisory-aa26-097a-ngernk13k og:image: https://api.daily.dev/og/posts/NGeRnK13k.png og:image:alt: Minnesota Water Cyber Attack and CISA Advisory AA26-097A og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Minnesota Water Cyber Attack and CISA Advisory AA26-097A **[Tenable Blog](https://daily.dev/sources/tenable-blog)** · 14 min read · 0 upvotes · 0 comments ## Summary A coordinated cyberattack disrupted water and wastewater systems across 30+ Minnesota communities on July 26-27, 2026, affecting cities including Braham, Plymouth, South St. Paul, and Maple Plain. The attack pattern is consistent with CyberAv3ngers, an IRGC-linked group. Four days prior, CISA updated Advisory AA26-097A to expand the scope of Iranian-affiliated PLC exploitation to include Schneider Electric and Siemens devices alongside Rockwell Automation, and documented new tactics including PLC project file exfiltration and manipulation of Add-On Instructions (AOIs) to disable safety systems. The key vulnerability, CVE-2021-22681 (CVSS 9.8), is an authentication bypass in Rockwell Automation Logix controllers with no available patch. Recommended mitigations include disconnecting PLCs from the internet, setting physical mode switches to Run, implementing IT/OT network segmentation, auditing cellular OT connections, and ingesting updated CISA IOCs. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Critical infrastructure’s long, undefended tail exposed by UK energy attack](https://daily.dev/posts/critical-infrastructure-s-long-undefended-tail-exposed-by-uk-energy-attack-hajfwhwyk) · CSO Online · 0 upvotes · 0 comments - [Siemens S7 PLC threat: What you need to know](https://daily.dev/posts/siemens-s7-plc-threat-what-you-need-to-know-xl3jbv20s) · Tenable Blog · 0 upvotes · 0 comments --- [View this post on daily.dev](https://daily.dev/posts/minnesota-water-cyber-attack-and-cisa-advisory-aa26-097a-ngernk13k) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Minnesota Water Cyber Attack and CISA Advisory AA26-097A","url":"https://daily.dev/posts/minnesota-water-cyber-attack-and-cisa-advisory-aa26-097a-ngernk13k","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/minnesota-water-cyber-attack-and-cisa-advisory-aa26-097a-ngernk13k"},"datePublished":"2026-07-29T03:24:27.628Z","dateModified":"2026-07-29T14:57:05.600Z","description":"A coordinated cyberattack disrupted water and wastewater systems across 30+ Minnesota communities on July 26-27, 2026, affecting cities including Braham,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/50dae873b398175917b0c1e08ea589dc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/50dae873b398175917b0c1e08ea589dc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Tenable Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Tenable Blog","logo":"https://media.daily.dev/image/upload/s--B6GAvw3H--/f_auto,q_auto/v1780213271/logos/tenable-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/tenable-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/minnesota-water-cyber-attack-and-cisa-advisory-aa26-097a-ngernk13k","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Tenable Blog","item":"https://daily.dev/sources/tenable-blog"},{"@type":"ListItem","position":3,"name":"Minnesota Water Cyber Attack and CISA Advisory AA26-097A"}]} ```