Braham was the most operationally complete attack of the four publicly disclosed incidents. The hackers disabled the town’s computerized operating controls, which shut down the well and the water treatment plant. For roughly two hours, Braham had no active water production — residents were living off whatever volume was already stored in the water tower. City Administrator Kevin Stahl told local media that the attackers used malicious software to compromise a wireless connection to the water plant. The town’s response was direct: shut the entire computer system down, cut external access, and wait for federal guidance on how to reconnect.

Braham’s mayor, Nate George, framed the incident in structural terms that apply to every small town on the list. Local governments are expected to defend essential systems against foreign adversaries and sophisticated criminals, often with limited staff, aging technology, and inadequate resources. A community of 1,700 people does not have a dedicated SOC. It has a city administrator who also handles budgets, roads, and zoning — and who is now also responsible for defending against an IRGC-linked threat actor.

Plymouth — population 80,000 and the largest of the four disclosed cities — reported that cellular communications at two water towers and multiple wastewater lift stations went offline late Sunday. Public Works Director Michael Thompson confirmed the city was operating the system manually. Denis Calderone, CTO of Suzu Labs, noted in SecurityWeek that the cellular communications vector is the revealing detail: water towers, lift stations, and pump stations connect back to the SCADA system over cellular modems, and those secondary communication links are frequently overlooked in risk assessments.

South St. Paul confirmed that automated controls were affected but Public Works staff maintained normal water and wastewater operations through manual procedures. Maple Plain went further and declared a local state of emergency to expedite the city’s response. Maple Plain officials also noted that some details about the incident cannot be shared because releasing them could raise risks to infrastructure or interfere with the ongoing cybersecurity investigation.

Minnesota IT Services classified the full list of affected Minnesota water systems as nonpublic, citing risks to infrastructure and the ongoing investigation. Only the four cities that voluntarily disclosed — Braham, Plymouth, South St. Paul, and Maple Plain — are named in the public record. That leaves at least 26 additional communities somewhere in Minnesota whose water or wastewater operational technology was targeted in the same 48-hour window, with no public accounting of what happened, how far the attackers got, or what remediation is underway.

The information gap is defensible from an operational-security standpoint — naming every affected system while the investigation is active could give the attackers intelligence about which defenses worked and which did not. But it also means that residents of those communities have no way to know whether their water system was touched, how the local response went, or what changes are being made. For a basic public service like drinking water, that opacity carries a different kind of cost.

Formal attribution for the Minnesota water systems attack is pending the federal investigation, but the circumstantial alignment is strong enough that multiple outlets have connected the dots. CyberAv3ngers is an Iranian state-directed threat group formally attributed to Iran’s IRGC Cyber-Electronic Command. The U.S. Treasury sanctioned the group in February 2024 after its first documented phase of U.S. water infrastructure attacks. Since then, CISA has tracked the group through four escalating capability phases, culminating in the July 22, 2026 update to Advisory AA26-097A that expanded the scope of targeted PLCs to include Schneider Electric and Siemens devices.

The suspected exploitation vector is CVE-2021-22681, a critical authentication bypass in Rockwell Automation Logix controllers rated CVSS 9.8. The flaw was disclosed in 2021 and added to CISA’s Known Exploited Vulnerabilities catalog in March 2026 after confirmed exploitation by Iranian-affiliated actors. There is no vendor patch. Rockwell has stated that the affected product generation will not receive a fix, which means every Logix controller in the field is permanently vulnerable unless the operator deploys compensating controls — network segmentation, key-switch enforcement, or physical disconnection from any reachable network path.

CISA’s update to Advisory AA26-097A on July 22 expanded the documented scope of Iranian PLC exploitation in three specific ways. First, it added Schneider Electric BMX P34/Modicon M340 and Siemens S7-1200 PLCs as confirmed targets alongside Rockwell Automation. Second, it documented project-file exfiltration for the first time — attackers stealing the programming files that define how a PLC operates, which gives them the blueprint to modify or sabotage the process. Third, it provided new detection guidance for manipulation of Add-On Instructions, the reusable code modules embedded in PLC programs.

The FBI observed at one victim facility that a malicious project file retained normal downstream ladder logic while inserting modified Add-On Instructions that disabled safety shutdown and alarm systems. The attackers also manipulated data on HMI and SCADA displays, allowing equipment to operate in unsafe conditions without alerting operators. That capability — disabling alarms while the equipment runs outside safe parameters — is the bridge between disruption and physical danger. It came four days before the Minnesota water systems were hit.

On July 28 — the same day MNIT activated its statewide cybersecurity response — CISA jointly published CI Fortify with Australia’s Signals Directorate, the UK’s National Cyber Security Centre, and Canada’s Centre for Cyber Security. The guidance advises critical infrastructure operators to isolate essential OT systems from the rest of their networks so that services keep running even if a breach occurs. The document is not formally linked to the Minnesota incident, but publishing Five Eyes OT isolation guidance on the same day as a statewide water-utility response is the kind of timing that does not happen by accident in the intelligence coordination world.

CI Fortify’s core recommendation is straightforward: segment OT networks so that compromise of the IT network or internet-facing systems does not give attackers a path to the controllers that run physical processes. For the Minnesota water systems that were hit through cellular modems connecting remote assets back to the SCADA system, that segmentation was either incomplete or not present. The guidance is free and public. Implementing it at a small water utility with no dedicated network engineer is the expensive part.

The Minnesota water systems attack is a demonstration of what happens when nation-state capability meets municipal-level defense. CyberAv3ngers, if the attribution holds, is an IRGC-backed group with documented capability across four phases of escalation, Treasury sanctions, and a dedicated CISA advisory. The defending organizations are small-town public works departments where the same person who manages the water plant also manages the sewer system, the streets, and the parks budget. That mismatch is not a failure of effort — it is a structural problem that no amount of advisory publishing can solve by itself.

The math is clear. There are approximately 50,000 community water systems in the United States. The vast majority serve small communities. Most do not have dedicated cybersecurity staff. Many run legacy SCADA systems with PLCs that are a decade or more old, connected to the internet through cellular modems or VPN tunnels that were set up once and never audited again. The Minnesota water systems incident is not an outlier — it is a preview of what happens when a determined actor decides to target the long tail of American critical infrastructure rather than the hardened top end.