01Summary
Plymouth, South St. Paul, Maple Plain and Braham confirmed disruption. Minnesota IT's security chief John Israel put the number of affected systems at about 36. Attackers shut down automated controls. Plymouth and South St. Paul switched to manual operation, and Braham could not fill its water tower for more than an hour. Drinking water stayed safe. CISA said actors were targeting programmable logic controllers and changing passwords "to lock out operators". APT IRAN posted on Telegram that the attack "was the work of the CyberAv3ngers group and us". A preliminary US assessment pointed to Iran, and by early August water systems in at least seven states, including Michigan, were implicated. President Trump blamed Minnesota and Governor Tim Walz, who accused him of lacking "a modern warfare plan to win against Iran".
02Technical analysis
- Attack method
- Tampering with PLCs and changing passwords to lock out operators
03Threat actor
CyberAv3ngers is an IRGC-affiliated persona known for attacking Israeli-made industrial controllers since 2023.
Aliases
- CyberAv3ngers
- APT IRAN
Attribution sources
- Preliminary US investigation
- Tenable
- APT IRAN Telegram claim
04Victims and impact
Additional victims
- Plymouth
- South St. Paul
- Maple Plain
- Braham
- Water systems in at least seven US states, including Michigan
Countries affected
- United States
05Timeline
- 2026-07-26Coordinated attack on Minnesota water systems begins.
- 2026-07-27Attacks continue; cities move to manual operation.
- 2026-08-01Reports link attacks across at least seven states, including Michigan.
06On the record
The attack on Minnesota was the work of the CyberAv3ngers group and us, and we take direct responsibility for it.
07Reaction and fallout
Political impact
Public blame exchange between President Trump and Governor Walz. Federal warnings issued to water utilities nationwide.
Geopolitical consequences
Part of Iran's cyber retaliation against the US during the 2026 Iran war.
08Significance and legacy
Significance
One of the most widespread disruptive attacks on US water infrastructure.
09Disclosure and media
Publishing organisations
- The Register
- CBS News
- Fortune
- ABC News
- KSTP
11Field notes
- 01Braham's water tower kept supply going while its controls were down.
12Sources
References
- [1]Wikipedia: https://en.wikipedia.org/wiki/2026_Minnesota_water_system_cyberattack
- [2]CBS News: https://www.cbsnews.com/news/us-investigating-iran-cyberattack-minnesota-water-systems/
- [3]The Register: https://www.theregister.com/security/2026/07/29/iran-linked-cyberav3ngers-suspected-in-attacks-on-minnesota-water-systems/5280357