Minot Water Treatment Plant Ransomware Incident

Analyst assessment

DysruptionHub assesses with high confidence that malicious cyber activity disrupted operational-technology capabilities at the City of Minot Water Treatment Plant on March 14, 2026. The city’s public information officer confirmed the ransomware characterization to Recorded Future News, while City Manager Tom Joyce told KMOT that staff unplugged the affected server and moved to manual operations. A Northwest Area Water Supply operations memo later said the breach involved the firewall and a downloaded ransomware virus.

The available evidence supports confirmed ransomware at the organizational-reporting level, but the technical behavior remains incompletely documented. Officials described a screen letter associated with the compromise, yet said it contained no direct request for money and that the city did not communicate with the sender. No source identifies a ransomware family, confirms file encryption or attributes the activity to a named group.

Operational significance

The incident removed the plant’s normal SCADA monitoring capability and required workers to make more frequent in-person gauge checks for about 16 hours. Joyce said technicians then started a backup server, restoring local monitoring. The city maintained water pressure in storage facilities, and officials said the plant and related water-system facilities remained operational throughout the event.

The incident also affected data sharing with the Northwest Area Water Supply system. The May 20 memo says NAWS terminated its link with Minot after the breach, found its own servers secure and returned its SCADA system to full operation March 17. NAWS operated temporarily in hydraulic mode, with local controllers maintaining pressure set points but without full system optimization. As of May 20, NAWS staff still could not view High Service Pump Station data because the connection with Minot remained disabled. The memo described the short-term operational effect as minimal.

This was a material utility-operations disruption even though it did not become a customer-facing outage. The City of Minot’s Water Treatment Plant page says the facility supports drinking water and firefighting needs in Minot and several other communities and operates reservoirs, elevated tanks, booster pump stations and flow-control vaults around the clock. Public reporting does not establish contamination, a boil-water advisory, loss of pressure or interruption of water delivery.

Disclosure posture

The incident became public March 31 through local reporting on a letter from the city manager to the City Council, more than two weeks after the March 14 event. DysruptionHub’s published article noted that reviewed council packets did not contain an obvious standalone copy of the ransomware letter. Joyce later said the public was not notified during the event because water remained potable, pressure was maintained and customers experienced no service problem. That explanation establishes the city’s stated reasoning, but the public record does not show a contemporaneous incident notice.

Current status

The plant’s material monitoring disruption ended after approximately 16 hours when technicians brought a backup server online. The connected NAWS system returned to full operation March 17, but the data link with Minot remained disabled May 20. No newer public source confirms whether that interconnection was restored. With more than 30 days since the latest documented limitation and no newer impact report, the incident is presumed resolved rather than positively confirmed resolved.

Confidence and uncertainty

Confidence is high that unauthorized access affected the SCADA server and forced manual monitoring because city officials directly confirmed those facts to multiple news organizations and the later NAWS memo documented the response. Confidence is also high that water quality, water pressure and service continuity were maintained. The ransomware classification is confirmed because the city repeatedly used that term, although the absence of a disclosed encryption finding or direct payment demand limits technical specificity.

Data impact remains unknown. Officials said the screen letter was transferred to the FBI and did not disclose whether the intruder viewed, copied, altered, encrypted or destroyed operational data, credentials, configuration files or other records. No threat actor has been identified and no public claim of responsibility has surfaced.

Analytic gaps

The public record does not establish the initial access vector, compromised account or device, exploited vulnerability, remote-access pathway, dwell time, malware family, encryption scope, persistence, lateral movement, affected SCADA components beyond the identified server and interconnection, data-access or exfiltration scope, ransom amount, restoration method beyond use of a backup server, vendor involvement, forensic indicators or responsible actor. It also does not establish when the Minot-NAWS SCADA connection was restored or provide a final FBI investigative conclusion.