Minnesota Water Utility Cyberattack: OT Security Lessons for NIS2 and CISA CIRCIA Compliance

The Attack: What Happened on July 26-27, 2026

Over the weekend of July 26-27, 2026, a coordinated cyberattack targeted operational technology (OT) systems at more than 30 water utilities across Minnesota. The attacks disrupted automated control functions, forcing several plants to switch to manual operations. The City of Braham reported its water plant was offline due to a malicious cyberattack and urged residents to minimize water use. Other communities experienced temporary equipment malfunctions but assured that drinking water remained safe and services were restored.

Minnesota IT Services (MNIT) activated a statewide incident response, collaborating with federal, state, local, tribal, and private partners. CISA, along with international partners, released guidance on isolating vital OT systems. The threat actor remains unknown, but state-sponsored hackers — possibly Iran-linked groups — are suspected based on prior warnings and tactics.

Attack Vector: Cellular Links and Overlooked Vulnerabilities

Experts believe the attack vector may have involved cellular communication links to remote assets — often overlooked in vulnerability assessments. Many water utilities use cellular modems to monitor and control remote pumps, valves, and sensors. These secondary communication paths can provide an entry point for attackers if not properly secured. The incident underscores the need for comprehensive OT vulnerability studies that include all communication channels, not just primary networks.

Compliance Lessons for US Critical Infrastructure Under CISA CIRCIA

The Minnesota attack highlights the urgency of the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA). Enacted in 2022, CIRCIA requires critical infrastructure entities to report significant cyber incidents to CISA within 72 hours and ransomware payments within 24 hours. The final rule is expected in 2025-2026. Water utilities classified as critical infrastructure must prepare to meet these reporting timelines and implement robust incident response plans.

Key US regulatory takeaways:

• Incident reporting: Ensure your organization can detect and report OT incidents within CIRCIA's 72-hour window.
• Network segmentation: Isolate OT networks from IT and external cellular links to limit attack spread.
• Supply chain risk: Assess vendor security for remote monitoring equipment and cellular communication providers.

Compliance Lessons for EU Entities Under NIS2 and DORA

For EU organizations, the Minnesota attack serves as a stark reminder of NIS2 Directive requirements. Transposed by member states by 17 October 2024, NIS2 applies to essential and important entities in sectors including water supply. Requirements include risk management measures, incident reporting (24-hour early warning, 72-hour notification), supply chain security, and management accountability. Penalties can reach EUR 10 million or 2% of global turnover for essential entities.

Additionally, the Digital Operational Resilience Act (DORA), applicable from 17 January 2025, imposes ICT risk management, incident reporting, and third-party risk management on financial entities — but the principles of operational resilience apply broadly. Water utilities should adopt similar frameworks: maintain ICT risk management plans, test digital operational resilience, and ensure third-party providers of OT systems are contractually obligated to report incidents.

Practical Steps for OT Security

Based on the attack and regulatory guidance, organizations should implement the following measures:

1. Network Segmentation and Isolation

Segment OT networks from IT and external connections. Use firewalls, one-way gateways, and VLANs to isolate critical control systems. CISA's guidance on isolating vital OT systems is a must-follow. Ensure cellular links to remote assets are encrypted, authenticated, and monitored.

2. Incident Response Plans Tailored to OT

Develop and test incident response plans that account for manual operations, communication with regulators (CISA for US, national CSIRT for EU), and public notification. Include scenarios where automated controls are lost and manual intervention is required.

3. Vendor Risk Management

Assess cybersecurity practices of vendors providing OT equipment, cellular modems, and remote monitoring services. Contractually require incident reporting and adherence to standards like IEC 62443. For EU entities, NIS2 mandates supply chain security measures.

4. Comprehensive Vulnerability Assessments

Include secondary communication paths (cellular, radio, satellite) in vulnerability assessments. Conduct regular penetration testing of OT environments, not just IT networks.

5. Continuous Monitoring and Threat Intelligence

Deploy OT-specific monitoring tools that detect anomalies in control system behavior. Leverage threat intelligence platforms to stay ahead of emerging attack patterns. For geopolitical and supply chain risk monitoring, platforms like AIGovHub SENTINEL provide real-time alerts on threats to critical infrastructure.

Key Takeaways

• The coordinated OT attack on 30+ Minnesota water utilities exploited cellular communication links to remote assets, a commonly overlooked vulnerability.
• US critical infrastructure entities must prepare for CISA CIRCIA incident reporting requirements (72-hour notification) and implement OT-specific security measures.
• EU entities under NIS2 must ensure risk management, incident reporting, and supply chain security for OT systems, with penalties up to EUR 10 million or 2% of global turnover.
• DORA principles of digital operational resilience — including ICT risk management and third-party oversight — apply broadly and should guide OT security programs.
• Practical defenses include network segmentation, OT-specific incident response plans, vendor risk management, comprehensive vulnerability assessments, and continuous monitoring.

Strengthen Your Critical Infrastructure Compliance

The Minnesota attack is a wake-up call for water utilities and other critical infrastructure operators worldwide. To navigate the complex regulatory landscape of CISA CIRCIA, NIS2, and DORA, organizations need robust compliance tools. AIGovHub offers a suite of cybersecurity compliance tools, including regulatory alerts, vendor due diligence assessments, and incident reporting templates. Explore our platform to automate compliance and protect your OT environment.

This content is for informational purposes only and does not constitute legal advice.