Cyberattacks highlight risks to Minnesota drinking water from aging IT systems

A coordinated cyberattack on more than 30 Minnesota community drinking water systems this week is the latest in a growing number of cyberattacks on drinking water systems nationwide.

The incident on July 26 and 27 targeted operational technologies like control valves and pumps and did not affect water quality, officials said. Some municipalities asked residents to conserve water for several hours.

Only four of the estimated 30 systems affected have been publicized: Braham, Maple Plain, Plymouth and South St. Paul. The rest of the systems that were affected are classified as “nonpublic,” according to a spokesperson at Minnesota IT Services, a state agency that provides IT services to over 70 agencies, boards, and commissions. 

In Maple Plain, a local state of emergency was declared to expedite the city’s response to the attack, which affected certain “automated control functions” in its water utility system. 

Similar automated functions were affected at South St. Paul’s drinking water system, requiring they operate the system manually. 

The Plymouth attack affected cellular communications at two water towers and several lift stations and also required they operate using “manual procedures.” 

Related: What falling wildfire ash means for Minnesotans who get their drinking water from lakes

And in Braham’s wastewater treatment plant, the wells that pump water to the local water tower were shut off. The technician who discovered the problem Monday morning alerted city officials to the issue, who then sent out a city-wide alert telling Braham residents to refrain from non-essential water usage. The water was back online by Monday night. 

Kevin Stahl, Braham city administrator, said the attack came from the outside. 

“You physically have to be in the plant to change chemical feed rates,” Stahl said. “There was no compromise to any of the flow rates of chemicals or anything like that… they just shut the water off to the well.” 

The source of the attack is currently being investigated by state and federal agencies, including the Federal Bureau of Investigation. 

Minnesota has been grappling with cybersecurity as a growing drinking water threat for several years after a 2023 investigation by the federal Environmental Protection Agency found over 70% of inspected community drinking water systems throughout the country lack basic emergency response plans for cyberattacks. 

Many Minnesota municipalities adopted risk mitigation plans in the years following — but keeping up with ever-evolving technology advancements has proved difficult, making them vulnerable to cyberattacks. 

“Some of our technology is, I’m not going to say old, but it is dated,” Stahl said. Computer systems need to be updated annually, which is a fast pace for local government agencies to keep up with. 

To protect their drinking water in the latest cyberattack, Braham officials simply shut their whole computer system down, cutting off external access to it. They’re now waiting for recommendations for how to move forward based on what the state and federal investigation into the cyberattack reveals. 

“We take our water and sewer infrastructure pretty seriously,” Stahl said. “And we thought all of our bases were covered, but bad actors, they also have a plan.”

Claire Carlson is a Report for America corps member, covering drinking water for MinnPost in Minnesota. Report for America places talented journalists in local newsrooms to report on under-covered issues and regions.

The post Cyberattacks highlight risks to Minnesota drinking water from aging IT systems appeared first on MinnPost.