As reported by SecurityAffairs, a coordinated cyberattack targeted operational technology (OT) systems across more than 30 Minnesota water utilities over the weekend of July 26–27, briefly forcing one treatment plant offline before backup procedures contained the disruption. While no widespread water service outages occurred, the security community should not mistake operational resilience for cybersecurity strength — these are very different things.

Key Takeaway: As reported by SecurityAffairs, a coordinated cyberattack targeted operational technology (OT) systems across more than 30 Minnesota water utilities over the weekend of July 26–27, briefly forcing one treatment plant offline before backup procedures contained the disruption.

Why This Incident Demands Serious Attention

The scale of this attack is what sets it apart. Targeting 30+ utilities simultaneously is not the work of an opportunistic actor probing a single exposed HMI panel. This suggests either a coordinated campaign leveraging a shared vulnerability, a common vendor platform, or a threat actor with substantial reconnaissance already completed. Water utilities in regional clusters frequently share the same SCADA vendors, remote access solutions, and even IT/OT integration partners — meaning one supply chain weakness or widely deployed unpatched system can become a force multiplier for attackers.

The fact that backup procedures prevented major service disruption is genuinely good news, but it also obscures a harder truth: manual fallback procedures are not a cybersecurity strategy. They are an emergency brake. Every time an incident is absorbed through manual operations, there is a temptation to chalk it up as a near-miss and move on without addressing the underlying attack surface.

The OT Security Gap in Water Utilities

Water and wastewater systems occupy a uniquely difficult position in the critical infrastructure landscape. Many operate on lean municipal budgets, inherit legacy control systems with 20+ year lifecycles, and lack dedicated OT security staff. The convergence of IT and OT networks — often driven by remote monitoring convenience — has dramatically expanded the attack surface without a corresponding investment in segmentation, monitoring, or incident response capability.

When an attacker can reach an HMI or PLC from the internet — even indirectly — the question is no longer if a disruption will occur, but when, and how prepared the operators will be when it does.

This incident also fits a broader pattern. CISA and the EPA have repeatedly warned about threat actors — including nation-state groups and hacktivists — actively scanning for and targeting internet-exposed water sector OT systems. The Volt Typhoon warnings from early 2024, the Cyber Av3ngers attacks on water systems in late 2023, and now this Minnesota campaign all point to water infrastructure as a target of increasing strategic interest.

Who Is Most at Risk

The OT Security Gap in Water Utilities
Small-to-mid-size municipal water utilities with shared vendor ecosystems and limited in-house cybersecurity staff
Utilities using internet-exposed HMIs or remote access without MFA or network segmentation
Systems running end-of-life SCADA or PLC firmware that cannot be patched or monitored effectively
Regional utility clusters sharing the same technology stack — a single exploited platform can pivot across dozens of systems

Shield53 Recommendations

Immediate Actions for Water Sector OT Defenders

  • Audit internet-facing OT assets immediately. Use tools like Shodan or your asset inventory to identify any HMIs, PLCs, or remote access portals exposed to the public internet. Remove or firewall them now.
  • Enforce MFA on all remote access. VPNs, RDP, and vendor remote support channels without MFA are open doors. This is non-negotiable in the current threat environment.
  • Implement OT-specific network segmentation. IT and OT networks should not share routing paths without strict, monitored demilitarization zones (DMZs) or data diodes where applicable.
  • Deploy OT-aware monitoring. Solutions like Claroty, Dragos, or Nozomi Networks can provide passive asset discovery and anomaly detection without disrupting fragile OT environments.
  • Review and test manual backup procedures. Backup procedures worked here — validate yours regularly and ensure operators are trained to execute them under stress.
  • Engage with WaterISAC. The Water Information Sharing and Analysis Center (WaterISAC) provides sector-specific threat intelligence and incident coordination resources tailored to utilities of all sizes.
  • Apply CISA's Water Sector Cybersecurity guidance. CISA has published free resources specifically for water utilities, including the 5-step ICS cybersecurity framework. There is no reason not to use them.

Strategic Guidance for CISOs and Water Authority Leadership

If your utility shares a vendor platform with neighboring systems, you need to treat their vulnerabilities as your own. Proactively coordinate with peer utilities and your state drinking water authority to share threat indicators, especially during active campaigns. Push your vendors for timely patching SLAs and security disclosure policies — many water sector OT vendors still lack mature vulnerability disclosure programs.

The Minnesota incident should accelerate conversations at the state and federal level about minimum cybersecurity baselines for water utilities. The EPA's attempted cybersecurity survey requirement was struck down in court in 2023 — but the threat environment has not improved since then. Voluntary guidance alone is not closing the gap fast enough.