BLUF: Starting July 26, a coordinated cyberattack disrupted more than 30 municipal water systems in Minnesota, with similar activity reported in six other states. Several utilities were forced onto manual operation. Federal officials suspect an Iranian-affiliated actor, though attribution has not been confirmed. The detail worth your attention is not who did it. It’s how they got in: through remote access hardware that operators didn’t know was connected to their networks. That gap exists in commercial environments too, and most standard security tooling isn’t built to find it.

What Happened in Minnesota

On July 26 and 27, attackers targeted operational technology at more than 30 community water systems across Minnesota, including facilities in Braham and Plymouth. Minnesota IT Services coordinated a response with state agencies, CISA, the EPA, and the FBI. Some affected utilities lost the ability to remotely monitor and control equipment and shifted to manual operation while investigators worked the incident. By July 30, the FBI, EPA, and CISA had issued a joint public service announcement warning that similar activity had been reported by water and wastewater utilities in at least seven states.

The technical pattern behind the intrusions traces back further than the Minnesota incident. CISA’s advisory AA26-097A, first published in April 2026 and updated on July 22, just days before Minnesota reported its attacks, describes Iranian-affiliated actors exploiting internet-connected programmable logic controllers, or PLCs, across the water, energy, and government services sectors since at least March. The July update expanded the list of affected equipment manufacturers to include Rockwell Automation, Schneider Electric, and Siemens.

Attribution for the Minnesota incident specifically remains unresolved. A memo distributed to water utilities through the Water Information Sharing and Analysis Center described the activity as consistent with the characteristics laid out in CISA’s April advisory, but stopped short of directly tying the attack to Iran. No malware samples or forensic artifacts pointing to a specific actor have been made public. Officials across multiple outlets have used the word “suspected.” That word is doing real work, and it should stay in place until there’s more to go on.

The Detail CISA Buried in the Advisory

Most of the coverage of this incident has focused on the PLCs themselves: exposed controllers, password changes, disconnected IP addresses. That’s a real problem, but it’s a familiar one. Vulnerability scanning and patch management exist to catch exactly that kind of exposure.

The line in CISA’s guidance that deserves more attention is this one: organizations should validate their external connections, because the targeting activity includes cellular modems installed by operators, vendors, or system integrators that “may not be documented or included in routine attack surface scans.”

Read that again. This isn’t a story about a missed patch. It’s a story about access points that never made it onto an asset inventory in the first place, because a vendor or integrator installed them at some point during a system deployment and nobody wrote it down. A utility can run a clean vulnerability scan, pass an audit, and still have a live cellular connection into its control systems that its own security team has never seen.

This Is Not a Water Utility Problem

Small municipal water systems get attention here because they’re an easy target: limited budgets, aging infrastructure, and control systems that were never designed with internet exposure in mind. But the underlying pattern, a vendor or integrator installing remote access hardware or software during a deployment that the client organization never fully catalogs, is not unique to water utilities.

It shows up in building management and HVAC control systems installed by a mechanical contractor. It shows up in manufacturing equipment with a remote diagnostics connection set up by the equipment vendor. It shows up in security camera systems, access control panels, and environmental monitoring sensors that arrive pre-configured with a cellular or cloud connection nobody on the security team requested. Any mid-market organization with operational technology, building systems, or specialized equipment maintained by outside vendors has some version of this exposure. The difference is usually just scale and visibility, not whether the pattern exists.

Why Standard Asset Inventories Miss This

Most attack surface management programs are built around what IT provisioned: laptops, servers, cloud accounts, and network devices that show up in a configuration management database because someone in IT set them up. Vendor-installed OT and IoT devices frequently fall outside that scope entirely, not because anyone is negligent, but because the ownership model is different. The vendor who installed the equipment considers the connection theirs to manage. The client organization considers the equipment itself, not its network footprint, the vendor’s responsibility. Nobody owns the inventory of what’s actually connected and how.

This is a scoping problem more than a tooling problem. A vulnerability scanner can only assess what it’s pointed at. If a cellular modem sits outside the IP ranges included in a scan, or communicates over a cellular network entirely separate from the corporate network, it simply doesn’t appear. An organization can have a mature vulnerability management program and still be blind to this category of access, because the program was never scoped to include it.

Vendor Access Is Not a Vendor Risk Questionnaire Problem

It’s worth being precise about what this isn’t. This isn’t a case for a longer vendor security questionnaire. Questionnaires ask vendors to describe their own security posture. They rarely ask, and vendors rarely volunteer, a complete list of every physical or remote connection a technician has established inside a client’s environment over the life of a relationship. That information usually doesn’t live in a questionnaire response. It lives in a technician’s install notes, if it’s documented anywhere at all.

The fix here isn’t a better form. It’s a physical and logical inventory exercise: walking the environment, identifying every piece of vendor-installed equipment with any form of connectivity, and confirming what that connectivity actually is. That’s a different exercise than compliance-driven vendor risk assessment, and it tends to get skipped precisely because it doesn’t fit neatly into an existing audit checklist.

What to Do This Quarter

A few concrete steps worth prioritizing, drawn directly from CISA’s guidance and applicable well beyond the water sector:

• Inventory remote connectivity, not just devices. For any operational technology, building system, or specialized equipment maintained by a vendor, confirm whether it has cellular, Wi-Fi, or internet connectivity, and who provisioned it.
• Log and monitor cellular modem connections separately. These often exist outside standard network monitoring entirely, which is exactly why they’re attractive to attackers.
• Restrict controller and PLC access to authorized systems only, and remove direct internet exposure wherever it exists.
• Inspect control system project files for unauthorized changes before restoring from backup, and validate that backups are clean before using them.
• Ask vendors directly, in plain language, what remote access they’ve installed, rather than relying on a questionnaire response to surface it.

None of this requires knowing who is behind the Minnesota attacks. The access pattern is the lesson, and it holds regardless of how the attribution question eventually resolves.

References

1. Cybersecurity and Infrastructure Security Agency, “Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure” (Advisory AA26-097A), updated July 22, 2026. https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a
2. CBS News, “U.S. investigating if Iran was behind cyberattack on water systems in 7 states, including Minnesota and Michigan,” August 2026. https://www.cbsnews.com/news/us-investigating-iran-cyberattack-minnesota-water-systems/
3. NBC News, “Hackers targeted municipal water systems in 7 states this week, FBI says,” updated August 3, 2026. https://www.nbcnews.com/tech/security/hackers-targeted-municipal-water-systems-7-states-week-fbi-says-rcna590210
4. Nextgov/FCW, “CISA urges water utilities to take exposed systems down after Minnesota hacks,” July 31, 2026. https://www.nextgov.com/cybersecurity/2026/07/cisa-urges-water-utilities-take-exposed-systems-down-after-minnesota-hacks/415142/