The criminals behind the Minnesota water attacks may have a better backup of your plant than you do
Hackers hit more than 30 small water utilities in two days. The most alarming detail isn't how they got in, it's that they may have walked out with the only complete copy of control logic the operators ever had.
Key points
- Criminals hit more than 30 Minnesota community water systems on July 26 and 27, 2026, disrupting remote control at several sites.
- Rockwell Automation MicroLogix 1400 controllers, small computers that manage physical equipment like pumps and valves, appear to link many of the affected utilities.
- A federal advisory, AA26-097A, documents that attackers stole PLC project files, the software blueprints that tell a controller exactly how to run a plant.
- Restoring a locked Rockwell controller requires an offline copy of that project file, something many small utilities do not have.
- Rockwell's recovery notice SD1790 describes no software flaw exploited; the attackers used normal administrative functions, just from somewhere they should never have been.
More than 30 small-town water utilities across Minnesota lost remote control of their equipment over two days last week. Some had it cut from them. Others cut it themselves while scrambling to contain an intrusion. Either way, taps kept running, and no contamination has been reported. The quick recoveries were real. So was the exposure underneath them.
The utilities ran Rockwell Automation MicroLogix 1400 controllers, think of these as small, specialised computers bolted to the wall of a pump station, running the exact sequence of steps that moves water safely from source to tap. Dozens of geographically scattered utilities sharing the same controller model is how two days of coordinated criminal activity touched so many sites at once.
How did the hackers get in?
They didn't exploit a software flaw. There is no CVE, which is the standard identification number assigned to known security vulnerabilities. Rockwell's July 30 recovery notice, SD1790, describes attackers using the controller's own administrative functions: changing an IP address, which is a device's network location number, and setting a password. Normal operations. Wrong hands.
That matters because no patch fixes it. The gap is access control, not broken code.
CISA, the US Cybersecurity and Infrastructure Security Agency, had been tracking related activity since March. A July 22 update to advisory AA26-097A expanded the known target list beyond Rockwell to Schneider Electric and Siemens devices. More significantly, it documented for the first time that attackers had stolen PLC project files. A PLC, or programmable logic controller, is the controller itself; its project file is the software recipe that tells it precisely how to operate a plant's physical equipment.
Why does a stolen project file matter so much?
Rockwell's own recovery procedure is the problem. If criminals lock a MicroLogix 1400 by changing its password, the recovery steps wipe the controller's program entirely. Operators must then reload the project file from an offline backup.
For utilities that have one, that's a two-hour job. Braham's water plant was back in roughly that time. Plymouth ran manually while cellular connections were rebuilt.
For utilities that don't have a current, verified offline backup, the situation is grimmer. Fifteen years of small tweaks by rotating technicians and multiple contractors often means the file on someone's laptop no longer matches what actually runs in the field. In that case, the criminals who stole the project file may hold the only accurate copy of how the plant works.
| Item | Detail |
|---|---|
| Incident dates | July 26 and 27, 2026 |
| Utilities affected | More than 30 Minnesota community water systems |
| Controller targeted | Rockwell Automation MicroLogix 1400 |
| Federal advisory | CISA AA26-097A (updated July 22) |
| Rockwell recovery notice | SD1790 (published July 30) |
| No CVE assigned | Attack used intended admin functions, not a flaw |
Researchers scanning Minnesota's public internet space found little obviously exposed water infrastructure. That sounds reassuring. It isn't. Many of these utilities connect over cellular networks, the same mobile data links a smartphone uses, and cellular paths don't show up in the standard scans defenders use to check their own exposure. The opacity cut both ways: the utilities were invisible to outside researchers and, effectively, invisible to themselves.
CISA's alert told utilities to check for undocumented cellular modems. The word "undocumented" is telling. The agency was warning operators that their own network diagrams are probably incomplete.
What should water utility staff and customers watch for?
Customers in affected towns face no immediate health risk based on current reporting. No contamination has been confirmed. But anyone in a small Minnesota community served by a water utility should watch for official notices about service disruptions over the coming weeks, particularly if crews appear to be doing unexpected maintenance at pump stations.
For utilities and their staff, the practical steps are immediate and mostly free. Pull the carrier phone bill and match every SIM card, the small chip inside a cellular modem, to a named device and a documented purpose. If a modem appears on the invoice but not on any diagram, that's the problem CISA flagged. Treat the controller's project file like source code: create an offline copy, date it, run a verification check by uploading the live program and comparing it against the archive, and repeat that process after any maintenance visit.
CSO Online's analysis of the incident rightly chased the attribution question. Attribution is the investigators' job. Backup discipline is everyone else's.
