Coordinated cyberattack hits more than 30 Minnesota water systems

On July 26 and 27, more than 30 municipal water systems in Minnesota were hit by a coordinated cyberattack on their operational technology (OT). The incident triggered a statewide response.

What happened on the ground

Several cities have publicly described the fallout. In Brainerd, a water treatment plant went offline, and residents were asked to conserve water until treatment resumed. In Plymouth, officials recorded cellular outages at two water towers and several sewage pumping stations, but kept operations running in manual mode. In South St. Paul and Maple Plain, services were maintained despite the impact on automated control systems; Maple Plain even declared a local state of emergency to coordinate the response.

On July 28, Minnesota IT Services (MNIT) clarified that it had no information about any active requests for the public to change how they use drinking water.

Plenty of unknowns

An important detail: the figure of “more than 30” reflects the number of systems that were targeted by the attack, not the number confirmed to have been breached or disrupted. How many facilities were actually affected has not been officially disclosed. Authorities have also not named the attacker, the method of initial access, the products affected, the vulnerability exploited, or whether any data was stolen. Nor have they publicly explained the basis on which the attack was deemed “coordinated” — whether the facilities were linked by a single perpetrator or a single method of access.

MNIT said it is coordinating containment, investigation and recovery together with CISA, the Environmental Protection Agency, the FBI and the affected utilities. “Cyberattacks on critical infrastructure require a coordinated, whole-of-government response,” said John Israel, MNIT's deputy commissioner and the state's chief information security officer.

The Iranian context

Four days before the Minnesota events, U.S. agencies expanded a warning about attacks by Iranian actors on internet-exposed programmable logic controllers (PLCs) made by Rockwell Automation, Schneider Electric, Siemens and others. In that campaign, the attackers downloaded and altered project files, manipulated data on operator panels and in SCADA systems, and disabled emergency-stop logic and alarms.

Officially, no link between the two stories has been established. Tenable noted that the timing and nature of the operations are consistent with the CyberAv3ngers threat ecosystem, while cautioning that attribution has not yet been confirmed.

CISA recommends that operators log cellular modem connections, restrict access to controllers, check running project files for unauthorized changes, and validate backups before restoring. As of July 29, the investigation was ongoing.

Source: The Hacker News