MINNEAPOLIMEDIA NEWS | Cyberattacks Disrupt Water Systems in Several Minnesota Communities

BRAHAM, MN (July 28, 2026). Minnesota cybersecurity officials are helping several cities investigate malicious attacks against computerized water infrastructure after municipal systems in Braham, Plymouth and South Saint Paul were targeted Sunday night and Monday.

The most significant publicly reported disruption occurred in Braham, an Isanti County community about 50 miles north of Minneapolis. City officials announced at 9:34 a.m. Monday that the municipal water plant was offline for an unknown reason.

Less than two hours later, the city reported that the plant had returned to service. Officials subsequently identified the cause as a malicious cyberattack against the plant’s computerized operating systems.

The attack disabled operating controls and caused Braham’s well and water-treatment plant to shut down temporarily, according to city officials. Public works employees identified the problem and restored the facility.

The city said the intrusion caused no physical damage to the water plant and did not compromise the quality or safety of the community’s drinking water. Residents were told they could continue using their water normally.

Plymouth and South Saint Paul Report Intrusions

Officials in Plymouth and South Saint Paul also reported cyberattacks involving their municipal water infrastructure.

In Plymouth, the activity reportedly began overnight Sunday and targeted computerized systems associated with water towers and sanitary sewer lift stations. South Saint Paul reported an attack involving its water utility system.

Officials in all three cities said the effects were limited and that municipal drinking water remained safe. South Saint Paul said it was working with state and federal authorities.

Braham officials said they were aware of at least four other Minnesota communities affected by similar activity. Minnesota IT Services said Monday evening that the investigation remained active and that officials did not yet know the total number of affected entities.

Authorities had not established publicly whether one person or organization was responsible for all the reported attacks.

State Cybersecurity Teams Join Response

Minnesota IT Services, known as MNIT, said it was providing technical and cybersecurity support to state and local partners.

The agency said its teams were helping assess the attacks, share threat information and support recovery and remediation. MNIT emphasized that determining the full scope of an intrusion requires a coordinated and methodical investigation.

The attacks underscore the importance of protecting municipal water infrastructure from unauthorized access. Modern water systems often rely on networked controls to operate wells, pumps, treatment processes, storage facilities and sewage lift stations.

Even when an intrusion does not contaminate drinking water, interference with those controls can interrupt service, disable equipment or force employees to operate systems manually.

Investigation Remains Open

Officials have not publicly identified the method used to enter the systems, whether ransomware or another form of malicious software was involved, or whether the attackers issued any financial or political demand.

They also have not disclosed whether the affected cities shared a software provider, security weakness or remote-access system.

Minnesota residents in the identified cities were not instructed to boil water or restrict consumption. Any future public-health advisory would come directly from local officials or state health authorities.

The incident remains under investigation, and the list of affected communities could grow as municipal and state technicians examine system records.

Sources: City of Braham information reported by CBS Minnesota; Minnesota IT Services and city statements reported by FOX 9; MPR News