A coordinated cyberattack targeted community water systems in 30 Minnesota communities over the last three days according to Minnesota IT Services (MNIT).
The agency immediately activated the state's cybersecurity incident response capabilities after the attacks.
Earlier on Tuesday, city officials in Braham, Minnesota reported a cyber attack was to blame for a water plant outage.
In a social media post Monday night, the city noted the cyber attack did not cause any issue to the physical water plant, or water quality or safety. Instead the attack shut down operating controls, causing the city to provide water to residence with only water held in the water tower.
Cyber attacks now appear to be impacting several communities across the state, including reported issues in South St. Paul, Plymouth, and Maple Plain where their City Council convened an Emergency Meeting Monday evening in a closed session to receive a security briefing, review response efforts, and discuss measures necessary to protect critical infrastructure and public services.
Maple Plain Mayor Julie Maas-Kusske declared a local state of emergency.
"Cyberattacks against critical infrastructure require a coordinated, whole-of-government response," said John Israel, MNIT Assistant Commissioner and Minnesota Chief Information Security Officer.
The investigation remains active, and MNIT says they continue to assess affected systems.
"MNIT is working side by side with our partners to share intelligence, support affected communities, and help utilities restore operations safely while strengthening defenses against future attacks," Israel continues. "This incident demonstrates why Minnesota has invested in strong cybersecurity capabilities and partnerships. Our response worked as intended, enabling agencies at every level of government to rapidly coordinate, contain the incident, and help prevent more serious impacts to critical services.”
The Minnesota Department of Health also continues to work directly with affected water systems to help ensure public health remains protected.
At this time, they are not aware of any active requests from Minnesota cities to have their residents modify their drinking water usage.
MNIT activated its incident response capabilities immediately after learning of the attack and continues to:
- Coordinate technical response activities across government partners.
- Share threat intelligence and indicators of compromise with affected organizations.
- Support incident investigation, containment, recovery, and remediation efforts.
- Monitor for related malicious cyber activity and coordinate with state and federal cybersecurity partners.
- Provide cybersecurity expertise and technical assistance to affected communities.
