A coordinated attack over the weekend of 26 and 27 July hit more than 30 community water and wastewater utilities across Minnesota. The attackers reached the operational technology running water towers and lift stations, not the office networks beside them.
Four municipalities have publicly confirmed involvement: Braham, Plymouth, South St. Paul and Maple Plain. In Braham, attackers locked operators out of the controls and the treatment plant went offline for about two hours.
What happened
The intrusions reached computerised controls and the cellular modems attached to water towers and lift stations. In Plymouth the targets were cellular-connected equipment at two water towers and several wastewater lift stations.
Braham was the sharpest case. With operating controls locked out, plant crews brought the site back using manual overrides. Elsewhere, operators disconnected cellular modems outright to contain the intrusion and keep water moving.
Minnesota IT Services activated a statewide incident response on 28 July, sending teams to help small-town operators with network cleanup, isolation and patching, with the state Department of Health assisting affected systems. No Minnesota city has asked residents to change how they use their drinking water, and the utilities involved have reported no impact on water safety.
How they got in
According to the analysis, the attackers got in through internet-exposed, misconfigured programmable logic controllers, using vendor engineering software. Cellular-connected equipment was particularly exposed, which is why pulling the modems was an effective containment step.
The federal advisory covering this activity, AA26-097A, was updated on 22 July — four days before the weekend in question. Its scope spans several controller families and the industrial protocols they answer on.
| In scope | Detail |
|---|---|
| Controller families | Rockwell Automation and Allen-Bradley PLCs; Schneider Electric BMX P34 and Modicon M340; Siemens S7-1200 |
| Ports to audit | 44818 (EtherNet/IP), 502 (Modbus), 102 (S7comm), 2222, and 22 |
| Vector | Internet-exposed or misconfigured PLCs reached via vendor engineering software |
| Aggravating factor | Cellular-connected OT equipment sitting outside the segmented network |
Scope as published in CISA advisory AA26-097A and summarised in vendor analysis. These are defensive details — device families and listening ports are what an operator needs to find its own exposure. We have withheld the mechanics of the malicious changes themselves.
The flaw at the centre has no patch
The analysis names CVE-2021-22681, a 9.8-rated authentication bypass in Rockwell Automation Logix controllers. It stems from an insufficiently protected cryptographic key, but the crucial detail for operators is that there is no vendor patch.
That changes what remediation means. With no patch to apply, the only fixes are architectural: take the controller off the public internet, set the physical mode switch to Run, segment IT from OT, audit cellular connections, and keep offline backups of controller logic.
It was on the known-exploited list four months earlier
The timeline becomes particularly stark when checked against our snapshot of the CISA Known Exploited Vulnerabilities catalogue.
| Event | Date | Gap |
|---|---|---|
| CVE-2021-22681 published | 2021 | — |
| Added to the CISA KEV catalogue | Thu 5 Mar 2026 | About five years later |
| Federal remediation deadline | Thu 26 Mar 2026 | 21 calendar days to act |
| Minnesota attacks began | Sun 26 Jul 2026 | 122 days after the deadline |
Catalogue dates read from our own server-side snapshot of the CISA KEV feed, version 2026.07.27. The 122-day gap is RECATOOLS arithmetic. Note the 21-day window: this entry predates the compression to three-day deadlines we reported earlier this month. Our <a href="/kev-deadline-calculator/">KEV deadline calculator</a> — our own first-party tool — converts those windows into working days.
The catch is who that deadline binds. KEV remediation dates apply to United States federal civilian agencies. A municipal water utility in a town of a few thousand people is not covered by them, has no obligation to act on them, and in many cases has nobody whose job it is to read the catalogue at all. The list said this was being exploited in March. The organisations most exposed to it were the ones the list does not reach.
What the attackers changed
What the modifications did is more concerning than how they were delivered. According to the analysis, a malicious project file left the normal downstream ladder logic intact while inserting modified routines that disabled safety shutdown and alarm functions.
That is a deliberate choice. A plant whose controls stop working announces itself immediately, as Braham did. A plant that keeps running normally with its safety interlocks and alarms quietly switched off looks fine from the control room and has lost the systems that exist to catch the next problem.
How much is sitting exposed
A Censys survey from April 2026 gives a sense of the wider exposure, identifying a lopsided concentration of internet-exposed hosts that respond to industrial protocols.
| Region | Internet-exposed industrial hosts | Share |
|---|---|---|
| United States | 3,891 | 74.6% |
| Rest of the world | 1,328 | 25.4% |
| Global total | 5,219 | 100% |
Censys survey, April 2026. The global total and the United States figure and share are as reported; the rest-of-world row is RECATOOLS arithmetic. These are hosts answering industrial protocols from the public internet — not all are water utilities and not all are vulnerable.
Those are devices answering industrial protocols from the public internet. Not all are water utilities and not all are vulnerable, but every one of them is reachable by anyone who looks.
Attribution is not settled
No official attribution has been made for the Minnesota incidents. Tenable researchers have said the patterns are consistent with past targeting by CyberAv3ngers, a group formally attributed to Iran's Islamic Revolutionary Guard Corps Cyber-Electronic Command, while noting that attribution here remains pending federal investigation.
That is a suspicion based on similarity, and we have not hardened it. The techniques described — finding exposed controllers and using vendor software against them — require persistence, not sophistication.
The caveats
- Only four of the 30-plus utilities have been named publicly. The full scope rests on state figures rather than individual disclosures.
- Attribution is unofficial. The CyberAv3ngers link is a researcher assessment of pattern similarity, not a federal finding.
- CVE-2021-22681 is named in the analysis of this activity, which is not the same as confirmation that it was the vector at every affected utility.
- The Censys count is a global survey of exposed industrial hosts, not a count of vulnerable water utilities.
- We have withheld operational detail on how the controller logic was altered. It is in the vendor research for defenders who need it.
Key takeaways
- More than 30 Minnesota water and wastewater utilities were reached over 26–27 July.
- Braham lost its controls for about two hours and recovered using manual overrides.
- CVE-2021-22681 scores 9.8 and has no vendor patch — remediation is architectural, not a version bump.
- It entered the KEV catalogue in March, 122 days before the attacks, under a deadline that does not bind municipalities.
- The modifications disabled safety shutdown and alarms while leaving normal logic running.
View author profile → · Editorial policy
