An attack on Minnesota water systems shows why security teams must inventory remote connections, govern PLC access and preserve manual operating capability.
A wave of malicious cyber activity targeted technology at more than 30 Minnesota community water systems in late July 2026, exposing how remote connections intended to simplify operations can become paths into essential infrastructure.
In Braham, attackers shut down operating controls for a well and water treatment plant, leaving the city temporarily dependent on water stored in its tower. Officials asked residents to conserve water for several hours, although the incident did not affect water quality.
In Plymouth, the attack caused communications outages at two water towers and multiple lift stations. City officials said the problem was limited to equipment connected through cellular communications. Public works crews kept the system running through manual procedures, and water levels and quality were unaffected.
State officials said most confirmed cases involved programmable logic controllers (PLCs) and the human-machine interfaces (HMIs) operators use to manage them. These incidents show attackers don’t need advanced process knowledge or sophisticated ransomware to disrupt a water utility. A changed credential or loss of telemetry can force operators to decide whether automation remains trustworthy.
Overcome shadow technology to find every external path into OT
Water utilities can’t secure connections they don’t know exist. An operational technology (OT) inventory must extend beyond PLCs and HMIs to cellular modems, remote terminal units, serial-to-IP gateways, vendor connections, VPNs, cloud-management portals and engineering workstations.
“Many smaller water and wastewater systems operate legacy OT environments with limited security resources. And internet-accessible controllers, weak credentials, or insufficient network segmentation can turn basic techniques into meaningful operational risk,” says Matt Hartman, chief strategy officer at Merlin Group. Hartman advises teams to identify public IP addresses and exposed management interfaces, then reconcile their findings with network diagrams, carrier records, vendor documentation and equipment inventories. That process must include connections installed by integrators or maintenance providers.
Reconciling those records against network diagrams takes sustained effort and OT familiarity. An inventory built once and never reviewed may drift from the physical plant it’s supposed to describe.
Cellular connectivity is not automatically internet-facing, but it remains an external communications path. Utilities must know who supports and administers each modem, whether it uses private or public addressing, and how access is logged and revoked.
"Ensuring default admin and passwords are either turned off, managed, or at a minimum, rotated from their default or shipped state, is considered foundational security practice," says Christopher Hills, chief security strategist at BeyondTrust. Hills recommends disabling unnecessary public access, replacing default credentials and removing unused services. Each remaining remote pathway needs a documented purpose, owner and review date.
Govern remote access and controller credentials
Utilities should treat remote access to a PLC or HMI as privileged access to a physical process. Shared passwords make it difficult to identify who changed a controller, revoke a contractor's access, or distinguish an operator from an attacker using the same credentials.
“When an attacker can change a credential and displace a legitimate operator, the underlying condition is that access was never governed in the first place,” says Shane Barney, chief information security officer at Keeper Security. Every operator and administrator should have an individual account tied to a known identity. Utilities should approve vendor access for a specific task, limit it to required devices and protocols, and expire it when the maintenance window ends. Privileged password changes should trigger an immediate alert.
Where a legacy controller can’t support multifactor authentication, a hardened gateway, jump server or VPN can enforce it before a session reaches OT. The intermediary should record the identity, source, destination, connection time and administrative activity. Direct controller access from the public internet should be eliminated.
The same controls must cover cellular equipment management. A compromised carrier portal, cloud console or integrator account can provide another route to alter connectivity even when the controller is not publicly exposed.
Monitor PLC and HMI changes directly
Enterprise security tools may show that a connection occurred without revealing what happened to the process equipment at the other end. “Traditional IT-focused monitoring may not detect direct interaction with a PLC,” Hartman says. Detecting direct controller interaction depends on both the monitoring coverage at the OT boundary and the operator's familiarity with normal controller behavior.
Utilities need visibility at the OT boundary and, where equipment permits, into controller and HMI activity. Alerts should cover new programming connections, password and network changes, modified controller logic, unexpected operating-mode changes, lost telemetry and repeated failed access attempts.
Teams should maintain known-good copies of PLC logic, HMI projects and device configurations for comparison with approved baselines. Logs from remote-access gateways, identity systems, firewalls and OT monitoring tools belong outside the monitored devices so an attacker cannot easily remove the evidence.
Segmentation limits what a valid connection can reach. PLCs and HMIs should occupy operational zones separated from business systems and unrelated treatment processes. Firewalls or gateways should permit only documented communications between known hosts, not broad access to the control network. “The focus now must be on resilience, assuming an adversary may gain access and ensuring they cannot move laterally or manipulate critical operations at scale,” says Louis Eichenbaum, federal CTO at ColorTokens.
Keep manual operations ready
Plymouth’s ability to maintain water service during the outage demonstrates why manual operations are a security control, not merely a contingency for equipment failure. Written procedures ensure staff can maintain treatment and distribution without improvising safe thresholds, especially when an incident occurs outside normal shift hours. These procedures should:
- explain how operators verify tank levels, pressure, flow and treatment conditions when telemetry fails
- detail which equipment can enter local control
- describe which safe limits apply
- list who can disconnect remote access
- include contact information for engineers, integrators, carriers, state officials and emergency responders
Utilities should practice their procedures under realistic conditions. A drill can isolate a remote link, simulate the loss of an HMI or cellular connection, require local readings and test the restoration of trusted configurations and credentials. It could expose missing documentation, inaccessible backups and faulty staffing assumptions before an attack.
Recovery also requires offline copies of controller logic and HMI configurations and a process for validating restored settings against the physical system. Operations personnel must confirm that pumps, valves, alarms and treatment processes respond as expected before reconnecting automation.
“The goal is not simply to stop every attack, but to ensure that a localized intrusion does not become a catastrophic operational event,” Eichenbaum says.
The attacks on Minnesota’s water system reveal how exposed remote connections and weak controller credentials can disrupt essential services without sophisticated malware. Protecting water systems requires OT asset visibility, secure remote access, network segmentation, controller monitoring and tested manual procedures, and it requires people who can apply them to a live process.
CompTIA SecOT+ covers capabilities across critical infrastructure, including OT architecture, asset management and cyber-physical incident response. Review the draft objectives and sign up for updates ahead of its December 2026 launch.