A cyberattack disabled operating controls at Braham’s municipal water plant in Minnesota on Monday, temporarily stopping its well and treatment operations and prompting officials to ask residents to conserve water.
Public works crews restored the plant within about two hours. The city said water was again being filtered and treated as expected and that the attack did not damage the physical plant or affect drinking water quality or safety.
The incident affected systems used to operate Braham’s water infrastructure, not just administrative computers or a public website. Braham is an east-central Minnesota city in Isanti County that provides municipal water and sewer services.
The city reported at about 9:30 a.m. that the plant was offline for an unknown reason and crews were troubleshooting the problem. At 11:25 a.m., officials said the plant was operating again and attributed the outage to a “malicious cyberattack” on computerized operating systems by unknown actors.
City officials said attackers shut down operating controls, stopping the well and water treatment plant. Braham asked residents to conserve water because the city was relying on the limited supply stored in its water tower while the plant was offline.
Braham said state personnel were helping affected communities address vulnerabilities and investigate the source of the activity. The city administrator also requested a review of Braham’s system vulnerability study to identify and mitigate weaknesses exposed by the attack.
The incident came five days after federal agencies updated a joint cybersecurity advisory warning that Iranian-affiliated actors were targeting internet-connected programmable logic controllers across U.S. critical infrastructure. The July 22 update added guidance for detecting malicious changes and urged operators to strictly control network access to the industrial devices.
Programmable logic controllers are industrial computers used to automate equipment and processes, including pumps, valves and treatment operations. The federal advisory describes active targeting of controllers from several manufacturers, but no government agency has publicly linked the Braham attack to the activity outlined in the warning.
Braham officials said they were told at least four other communities were attacked “with the same result.” South St. Paul and Plymouth later reported cybersecurity incidents affecting technology used in their water or wastewater operations.
South St. Paul said some automated controls were affected, but public works employees used contingency procedures to maintain normal water and wastewater operations. The city said drinking water remained safe and residents did not need to take action.
Plymouth reported that two water towers and multiple wastewater lift stations were affected. Officials said water safety was not compromised and state cybersecurity personnel were helping assess the incident.
Chip in once
If this reporting helped you, a one-time tip helps cover hosting, tools and future investigations.
Support us monthly
A small monthly pledge keeps independent coverage and our reader tools online for everyone.
The Minnesota incidents followed a March ransomware attack on the water treatment plant in Minot, North Dakota. Minot temporarily lost access to its supervisory control and data acquisition system and used manual gauge readings for about 16 hours while employees installed a replacement server. The city said its water remained safe throughout the disruption.
Minot’s plant serves about 80,000 water users in the city and surrounding communities through the Northwest Area Water Supply system. Officials found a ransom note on the affected server, but it did not specify a payment amount, and the city paid no ransom.
Braham has not disclosed how attackers gained access, what equipment or software was compromised, or whether the incident involved the programmable logic controllers discussed in the federal advisory. No malware family or threat actor has been identified.
Officials also have not said whether data was accessed or stolen, whether a ransom demand was made, or whether the incidents in Braham, South St. Paul and Plymouth were carried out by the same party. At least two of the other communities referenced by Braham had not been publicly identified Monday.
