A coordinated cyberattack struck more than 30 community water and wastewater systems across Minnesota on the nights of July 26 and 27, temporarily shutting down one city's water treatment plant, forcing others to disconnect automated equipment, and triggering a statewide emergency response involving the FBI, CISA, and the EPA. Security researchers at Tenable believe the attack bears the hallmarks of CyberAv3ngers — a hacking operation formally attributed to Iran's Islamic Revolutionary Guard Corps and one of the most documented state-directed threats to U.S. water infrastructure, according to MNIT's statewide cybersecurity response statement and Tenable's Research Special Operations FAQ.
The attack came four days after federal agencies updated a landmark advisory warning that the same Iranian-affiliated actors had expanded their campaign beyond Rockwell Automation controllers to include equipment from Siemens and Schneider Electric. It was enabled, researchers say, by a critical authentication bypass in Rockwell Automation's widely deployed Logix PLCs — a flaw rated CVSS 9.8 out of 10, first disclosed in 2021, and for which Rockwell itself has confirmed no patch exists or is coming, as detailed in CISA Advisory AA26-097A and on Tenable's CVE-2021-22681 vulnerability page.
What the Attacks Disrupted in Minnesota
In Braham — a community of roughly 1,700 people in east-central Minnesota — the attack disabled the computerized controls governing the city's well and water treatment plant and temporarily shut the facility down. Public works crews restored service within approximately two hours. The Braham attack was the most operationally complete of the confirmed incidents; the city's mayor, Nate George, framed the incident as a symptom of a structural problem that extends well beyond Braham. "Minnesota's local governments are expected to defend essential systems against foreign adversaries and sophisticated criminals, often with limited staff, aging technology and inadequate resources," he said.
Plymouth — with a population of approximately 80,000 — had a different experience. Rather than losing service, the city's IT division took a preemptive step: it disconnected the cellular-connected equipment at two water towers and multiple wastewater lift stations from the network to stop the intrusion and prevent re-targeting while systems were reconfigured. Operations continued through manual procedures throughout. South St. Paul reported that some automated utility controls were affected but that contingency procedures prevented any major impact to operations. Maple Plain declared a local state of emergency to accelerate its response, according to the MNIT statewide cybersecurity response statement.
Minnesota IT Services (MNIT) confirmed the incidents shared a common profile — similar timing, access methods, and target types — and described them as a coordinated attack on operational technology at community water systems statewide. No boil-water advisories were issued. The Minnesota Department of Health confirmed that drinking water quality was unaffected at all impacted systems. As of July 29, the investigation remained active; authorities have not publicly identified the attackers, the access method used, the specific equipment affected, or whether any data was exfiltrated, as MNIT's official blog confirmed.
Read more: Iranian Hackers Infiltrate Siemens and Schneider PLCs, Blinding Operators With Fake Readings
Four Days Before: A Warning That Went Unheeded
The timing of the Minnesota attacks is not incidental. On July 22 — precisely four days before the intrusions began — CISA, along with the FBI, NSA, EPA, and the Department of Energy, published a significant update to Advisory AA26-097A, titled "Iranian-Affiliated Cyber Actors Exploit PLCs Across U.S. Critical Infrastructure," as documented on the CISA advisory page.
That update substantially expanded what was already a serious warning in three ways. It broadened the scope of confirmed targeting beyond Rockwell Automation devices to include Schneider Electric and Siemens PLCs — specifically the Schneider Electric BMX P34/Modicon M340 and the Siemens S7-1200 — and noted activity on ports associated with additional OT vendors, suggesting opportunistic targeting beyond the named manufacturers. It documented, for the first time, confirmed exfiltration of PLC project files: using legitimate vendor engineering software — Rockwell's Studio 5000 Logix Designer, Schneider's EcoStruxure Control Expert, and Siemens' TIA Portal — hosted on leased third-party infrastructure, attackers had been pulling industrial control project files out of victim environments and transferring them to systems under their control.
And it added new detection guidance for the manipulation of Add-On Instructions, or AOIs — reusable code modules embedded in PLC programs. In one confirmed incident documented by investigators, actors inserted malicious AOIs into an otherwise normal PLC project file that disabled safety shutdown and alarm systems, while simultaneously feeding falsified data to operator displays to mask what was happening at the hardware level. Operators watching a normal-looking screen had no indication that the equipment beneath it was operating in an unsafe state, according to Tenable's full technical FAQ on the Minnesota attacks.
"CISA's updated reporting shows a worrying expansion in Iran-linked critical infrastructure targeting focused on the United States," the agencies warned, urging water systems, energy providers, and government facilities to remain on high alert, per CISA Advisory AA26-097A.
The Flaw That Cannot Be Fixed
At the center of the current Iranian campaign is CVE-2021-22681, a critical authentication bypass in Rockwell Automation's Logix controller family. The flaw is architectural: the cryptographic key Rockwell's Studio 5000 Logix Designer software uses to authenticate communication sessions with Logix PLCs is embedded in the software in a recoverable form. Anyone who can extract that key — and Iranian-affiliated actors have clearly done so — can impersonate legitimate engineering software and gain direct, unauthenticated access to any internet-facing Logix controller. Once connected, the attacker has engineering-level privileges: they can download project files, upload modified logic, disable alarms, and alter what operators see on their screens, according to Tenable's CVE-2021-22681 vulnerability page.
CVE-2021-22681 was disclosed by Rockwell Automation in February 2021 and assigned a CVSS 3.x severity score of 9.8 out of 10. The flaw went unexploited in the wild for five years — not because it was obscure, but because OT environments are extraordinarily difficult to patch. Water treatment plants, energy facilities, and wastewater systems cannot take their industrial controllers offline on a standard IT patching cycle without disrupting services that must run continuously. The result is a permanent gap: a critical, known vulnerability sitting exposed in infrastructure that cannot safely be updated to close it.
Confirmed in-the-wild exploitation began in March 2026, when CISA added CVE-2021-22681 to its Known Exploited Vulnerabilities catalog following documented attacks by Iranian-affiliated actors. Rockwell Automation has since confirmed what was already clear from the flaw's architecture: there is no patch available and none is forthcoming. The authentication system would have to be redesigned from the ground up — at the cost of compatibility with every PLC already deployed. The only path to remediation is architectural, not software-based: network segmentation, engineering workstation isolation, enabling CIP (Common Industrial Protocol) Security, and removing these controllers from direct internet exposure.
As of April 2026, Censys analysis identified 5,219 internet-exposed hosts globally that responded to industrial protocols and self-identified as Rockwell Automation or Allen-Bradley devices, acco