Analyst assessment
DysruptionHub assesses with high confidence that Brown City experienced a malicious cyber incident that disrupted a municipal water well. Brown City’s Aug. 10 council minutes say attackers used a cellular connection to change the IP address of Well No. 3 and staff corrected the problem within a couple of hours. Sanilac County News reported that the change stopped the well from producing water during that period.
DysruptionHub assesses with medium confidence that the incident was part of the late-July 2026 campaign against water-sector operational technology. The IP-address change and cellular access match an FBI and Environmental Protection Agency warning. Brown City used UIS SCADA for system-control support, Alpena News reported that UIS told customers its July 27 incident involved programmable logic controllers and supporting communications, and Algonac records document a third Michigan water-system incident involving cellular modems, remote PLCs and UIS remediation. The three-city pattern supports a possible shared-provider or configuration exposure, but it does not establish that UIS itself was breached, that a supply-chain attack occurred or that one actor caused all three incidents.
Operational significance
The change interrupted a municipal well’s ability to produce water for about two hours. Public Works Foreman Mike Vislosky corrected the problem, and officials reported no physical damage. City Manager Kyle Harris said unauthorized pump switching could have damaged motors or other equipment and reduced the city’s water supply, but the public record does not document unsafe water or a public-health impact.
Current status
Brown City said staff restored the well and added security controls. The council authorized up to $5,000 for Pierson Ferdinand to review the response and whether UIS was taking appropriate protective steps. The Aug. 10 minutes say UIS had not responded to Harris’s inquiries at that time. The Aug. 24 council minutes approved the Aug. 10 minutes as written and recorded no further cyber update.
Disclosure posture
The first identified public disclosure occurred at the Aug. 10 City Council meeting. The first located written account was published Aug. 26. Brown City did not acknowledge or respond by Sept. 15 to questions DysruptionHub emailed Sept. 10.
Confidence and uncertainty
Confidence is high that cyber activity caused the disruption because Brown City’s minutes and local reporting document the unauthorized IP-address change, cellular access and operational effect. Confidence in the campaign link is medium because the technical pattern and three documented UIS-linked Michigan incidents align, but no authority publicly named Brown City as a confirmed campaign victim.
Ransomware and threat-actor attribution remain unresolved. Searches for Brown City and its domain found no ransomware or extortion claim, but negative results do not establish absence. The public record does not establish data access, theft or exposure.
Analytic gaps
The public record does not establish the exact attack date, initial access vector, affected PLC model, credentials, source IP addresses, dwell time, full vendor compromise path or actor identity. It also does not establish whether control logic changed, other city assets were accessed or forensic review found data exposure.
