Iran cuts off tap in Minnesota

Article by Nacata Security, 03/08/2026

Did you know that attacking a city’s water supply is easier than you think?

More than thirty water systems were compromised in Minnesota over a single weekend.

Water and sanitation systems have long been a priority target because they typically lack the budget to keep their equipment updated and apply basic security patches.

This makes them the perfect target: they are easy to penetrate, and the panic they generate among the population is immediate, multiplying the impact without requiring extreme sophistication.

The entry vector was no technical mystery.

Most of the confirmed attacks targeted the technology that water systems use to remotely monitor and control their equipment. These systems, known as OT (operational technology), include PLCs and SCADA systems that manage wells, treatment plants, and valves. When an attacker gains access to those controls, they can shut down entire facilities from anywhere on the planet, without ever setting foot on the premises.

The well and the treatment plant were shut down.

The attackers disconnected the operational controls that kept Braham’s well and water treatment plant running. For hours, the only available water was what was stored in the tower. In Plymouth, a city of approximately 80,000 residents, water infrastructure communications were disrupted, although operators kept the service running manually without affecting water quality.

No unpatched OT system is truly out of reach for an attacker.

Unprotected remote access makes everything easier.

When industrial control systems are exposed to the internet without robust authentication or network segmentation, an attacker with moderate resources can disrupt essential services. Understanding how that vector works is the first step toward closing it.

Iran has been perfecting this tactic for years.

In 2016, the Department of Justice charged Iranian hackers with attacking a dam near New York. Since then, interest in water infrastructure has only continued to grow. Cynthia Kaiser, former deputy assistant director of the FBI’s cyber division and now vice president at Halcyon, notes that Iran has clear geopolitical motivations and a track record that makes it the primary suspect.

Attribution remains the most complicated link in the chain.

Investigators detected similarities among the attacks: the same type of technology compromised and an almost identical time window. Even so, they could not confirm whether they share a common author. That ambiguity is part of the design: sowing confusion before anyone can be identified.

Uncertainty is also an offensive weapon.

While response teams try to determine whether a single actor is behind the attacks, the clock is ticking. Every hour without a clear answer is an hour in which the population does not know whether they can turn on the tap. That uncertainty, even in the absence of real physical damage, already fulfills part of the attacker’s objective.

Psychological damage also counts as impact.

Understanding how these attacks on OT infrastructure work is essential for demanding that local governments invest in protecting it before the tap stops working.

Would you be able to detect if someone were controlling your infrastructure without you noticing?

Security is not improvised, it is audited. At Nacata Security we detect vulnerabilities and protect your company, because a single flaw can cost you everything you have built.

Related articles

Nacata Security, reach out to us anytime