A "coordinated cyberattack" targeted more than 30 community water systems in Minnesota, prompting an ongoing response involving state, federal and local authorities, officials announced July 28.
The cyberattacks occurred on July 26 and 27 and affected operational technology used by community water utilities, according to Minnesota IT Services, the state's technology agency. Officials said the investigation remains active as cybersecurity teams assess the extent of the impacts and assist affected communities.
Minnesota IT Services, known as MNIT, said it immediately activated the state's cybersecurity incident response capabilities after learning of the attacks.
Cybersecurity teams are sharing threat intelligence, providing guidance on response
efforts and helping affected utilities contain, investigate and remediate damage from the attacks, MNIT said in a news release on July 28. The agency also is monitoring for related malicious cyber activity and coordinating with state and federal cybersecurity partners.
"Cyberattacks against critical infrastructure require a coordinated, whole-of-government response," John Israel, MNIT assistant commissioner and Minnesota's chief information security officer, said in a statement. "MNIT is working side by side with our partners to share intelligence, support affected communities and help utilities restore operations safely while strengthening defenses against future attacks."
The Minnesota Department of Health is working directly with affected water systems and said public health remains protected, according to MNIT. At this time, officials said they are not aware of any active requests from Minnesota cities asking residents to change their drinking water usage.
Authorities have not identified a suspect or disclosed additional details about how the attacks were carried out. The investigation remains ongoing as officials evaluate affected systems and work to restore normal operations where needed.
The FBI said in a statement that it was aware of the incident and was in contact with victims "to resolve the matter."
Minnesota cities report cybersecurity incidents involving water systems
On July 27, multiple Minnesota cities reported cybersecurity incidents that impacted their water utility control systems.
In a statement released at around 9:34 a.m. local time, the city of Braham said its water plant was offline for an unknown reason, and crews were working to solve the problem. By about 11:25 a.m., city officials said the water plant was back online, and the outage was a "result of a malicious cyber-attack of computerized operating systems by unknown actors."
"This attack did not alter or cause any issue to the physical water plant or water quality or safety. Rather, the attackers shut down the operating controls which shut down the well and water treatment plant," the city said in a news release, noting that at least four other communities were attacked with the same result.
The city of South St. Paul reported that it identified a cybersecurity incident involving technology used to support portions of the city's water utility system on the morning of July 27. The city said in a statement that the incident affected certain automated controls, but contingency procedures were implemented and allowed public works staff to maintain normal water and wastewater operations.
Similarly, the city of Maple Plain also announced that a cybersecurity incident impacted parts of its water utility system and contingency procedures helped city workers maintain operations without interruption.
"This issue has affected numerous communities throughout Minnesota and is part of a broader cybersecurity event impacting municipal utility systems," city officials said in a news release.
In Plymouth, officials said an issue was affecting communications at two of the city’s water towers and multiple lift stations within the city. The outage began overnight on July 26, and the cause is suspected to be a cyberattack, the city said in a statement.
"Water levels and water quality are unaffected – the water is safe and there is no need for the public to adjust consumption," according to the city. "The issue is limited to equipment connected via cellular communications within the system, and crews have continued operating as normal through manual procedures."
Cybersecurity threats against critical infrastructure in US
The cyberattacks highlight ongoing concerns about cybersecurity threats targeting critical infrastructure, including drinking water systems.
The U.S. Environmental Protection Agency previously said federal agencies have issued numerous advisories warning of cyber threats to water and wastewater systems from foreign groups, including Iran's Islamic Revolutionary Guard Corps, and state-sponsored groups linked to Russia and China.
While it is not yet clear who is responsible for the attacks in Minnesota, Iranian-linked hackers have for years targeted U.S. water systems to varying levels of success, according to Reuters.
An April 7 CISA advisory warned that Iranian-affiliated hackers were attacking internet-facing programmable logic controllers, computer devices used to interact with machinery and other critical infrastructure networks, manufactured by Rockwell Automation.
A July 22 update to the advisory expanded the scope of the targeting to include devices manufactured by Schneider Electric, Siemens and potentially other manufacturers.
"CISA’s updated reporting shows a worrying expansion in Iran-linked critical infrastructure targeting focused on the United States," Joe Slowik, director of threat research and cyber engineering at cybersecurity firm Dataminr, said in a July 27 blog posted to the company's website.
While the initial advisory was concerning enough, Slowik said, "Extending this activity to encompass additional equipment lines and pairing this with process manipulation and safety degradation makes matters more concerning as it enables various physical impact scenarios."
Contributing: Reuters
This article originally appeared on USA TODAY: 'Coordinated cyberattack' targets over 30 water systems in Minnesota
