There's cyberattack news, and then there's cyberattack news involving the thing that comes out of your faucet. This week Minnesota got a firsthand lesson in why "boring municipal infrastructure" is actually some of the highest-stakes software on the planet — and, thankfully, a lesson in how well-drilled incident response can also work.
Thirty-Plus Water Systems, One Very Bad 48 Hours
On July 26 and 27, a coordinated cyberattack hit the operational technology behind more than 30 community water systems across Minnesota. The city of Braham had its water treatment plant knocked fully offline after crews identified a malicious attack on its computerized operating systems, though service was restored within hours. Plymouth lost cellular communications at two water towers and several wastewater lift stations but kept things running manually. South St. Paul and Maple Plain both saw their automated utility controls affected and switched to backup procedures without interrupting service.
Minnesota IT Services activated a statewide cybersecurity incident response, pulling in local, state, and federal partners including the FBI. As of this week, officials haven't said who's behind it or why — no ransom note, no claimed motive, just a coordinated hit across dozens of small utilities in the same 48-hour window.
The Boring Infrastructure Is the Target Now
Water treatment plants aren't glamorous, which is exactly why they're such an appealing target: small municipal utilities often run decades-old industrial control systems with skeleton IT staff and, historically, exposed programmable logic controllers that state-sponsored actors have poked at before. This wasn't one plant with bad luck — it was over 30, hit in a coordinated window, which points toward a scanning-and-exploiting operation rather than an opportunistic one-off.
The genuinely good news buried in this story is that it worked the way resilience is supposed to work. Manual overrides kicked in, nobody's water stopped flowing for more than a few hours, and the state's response machinery activated fast. That's not nothing — plenty of these stories end with a much worse paragraph two.
Consider this the universe's way of reminding critical-infrastructure operators everywhere that "it's just a water pump" was never a security posture.
Source: BleepingComputer