2026 Minnesota water system cyberattack

From July 26 to July 27, 2026, a "coordinated cyberattack" targeted more than 30 municipal water systems in the U.S. state of Minnesota. The cities of Plymouth, South St. Paul, Maple Plain, and Braham publicly confirmed the attacks.^[1] A preliminary report by American investigators suggested that Iranian hackers were probably responsible for the cyberattack but also stressed that their assessments could change.^[2]

The cyberattack occurred at more than 30 community water systems in Minnesota in July 26 to 27, 2026, the state activating cybersecurity responses in response. The cities of Plymouth, South St. Paul, Maple Plain, and Braham confirmed the attacks.^[1] The Minnesotan cities specifically saw outages that disrupted the automated water utilities. US federal officials had previously warned that hostile countries like Iran-affiliated hackers had potential interest in attacks on American infrastructure. Braham city administrator Kevin Stahl said that unknown malware shut down operating controls to the water plant there, leaving the water tower being unable to be filled for over an hour. Both the Plymouth and South St. Paul systems had to switch to manual operations of the water systems. Maple Plain mayor Julie Maas-Kusske instated a local state of emergency in response to the cyberattack and implemented crew responses to restore the water systems.^[3]

Following the attack, the Minnesota IT Services (MNIT) confirmed that it was working with partners to investigate the cyberattack and strengthen protections of Minnesotan infrastructure, including the Minnesota Department of Health. Local Minnesotan officials confirmed that they had never before seen their cities be subjects of a wide-scale cyberattack and felt that their cities specifically were deliberately targeted.^[4][5] The MNIT commented that it had no report of requests from Minnesotan cities to change drinking water usage.^[6] The affected cities all later stated that the impacts of the attacks were limited to the extent that local residents could still drink water safely.^[1]

On July 30, 2026, The New York Times confirmed from a preliminary report that American investigators believed that Iranian hackers were probably responsible for the cyberattacks on the Minnesota cities' water systems, a possibility of an "act of aggression" amid the 2026 Iran war in which the United States is conducting strikes against Iran. They stressed that the report was preliminary and subject to change, thus considered the possibility that the Iranian-affiliated actors may be attempting to increase war tensions but stated that it may be an unlikely scenario. An FBI spokesman confirmed awareness of the incident, and a former FBI senior official said that Iran had previously sought to target American water supplies. MNIT chief information security officer John Israel confirmed that about 36 municipal water systems in Minnesota were affected by the cyberattack.^[2] ABC News reported that both federal and state authorities are investigating the incident.^[7] A communication leaked to Wired that was made by the information sharing group Water Information Sharing & Analysis Center (WaterISAC) suggested that Iranian-linked hackers were likely responsible for the water system cyberattack.^[8]

US President Donald Trump speculated that Iran was not behind the cyberattack, instead blaming the state of Minnesota and governor Tim Walz as "incompetent".^[9][10] Walz accused Trump of covering up the party responsible for the cyberattack and argued that Trump lacked a modern warfare plan to win against Iran.^[11]

• 2025 St. Paul cyberattack