Coordinated Rockwell MicroLogix PLC attacks disable 30-plus Minnesota community water systems

On July 26-27, 2026, unknown actors conducted a coordinated cyber campaign against more than 30 community water systems across Minnesota, gaining remote access to Rockwell Automation MicroLogix 1100 and MicroLogix 1400 programmable logic controllers connected to the internet via cellular modems. Attackers changed device IP addresses and authentication passwords, locking operators out of their own equipment, and modified ladder-logic governing alarm functions, automated shutdown procedures, and pressure-relief mechanisms at multiple sites. Named victims include Braham (Isanti County), Plymouth, South St. Paul, and Maple Plain, which declared a local state of emergency. Water pressure loss and flooding were reported at affected facilities. The FBI and EPA issued a joint advisory on July 30 confirming incidents across at least 7 states and specifically identifying Rockwell MicroLogix 1100 and 1400 as the targeted device families; Rockwell Automation issued security advisory SD1790 the same day. No attribution was officially confirmed as of July 31. Tenable assessed the tactics as consistent with the CyberAv3ngers threat ecosystem (IRGC-CEC affiliated), which had previously targeted Unitronics PLCs at the Aliquippa, Pennsylvania Municipal Water Authority in November 2023 and conducted broader Allen-Bradley and Siemens campaigns throughout 2026.

Operational disruptions at 30-plus Minnesota water utilities including water pressure loss, flooding, and forced manual operations; Maple Plain declared a local state of emergency; Braham temporarily shut down portions of its water system; Plymouth disconnected cellular-connected equipment at water towers and wastewater stations. The FBI and EPA confirmed incidents across at least 7 states with some activity degrading water operations. No confirmed public health impact, injury, or water quality incident. Financial losses not disclosed.