[2026 U.S. Water Utilities Attacks](https://attack.mitre.org/campaigns/C0066) was a campaign against more than 30 municipal water and wastewater utilities in Minnesota, beginning 27 July 2026, amid a wider pattern of similar activity the FBI and EPA reported across at least seven U.S. states.(Citation: Dragos Water Under Attack)(Citation: FBI Water and Wastewater) The adversary targeted internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series programmable logic controllers reachable through cellular gateways at water towers and sewer lift stations, remotely accessing them and reconfiguring their IP addresses and passwords to lock operators out of monitoring and control functions.(Citation: Tenable Minnesota Water Utilities)(Citation: Forescout Water Systems Attack) At least one victim organization's PLC program logic was altered, and reported operational effects included loss of water pressure and flooding, with one utility taking its treatment plant offline entirely.(Citation: Forescout Water Systems Attack)(Citation: FBI Water and Wastewater) The campaign has not been formally attributed; some reporting describes the broader pattern as consistent with Iranian-affiliated activity, but attribution for the Minnesota intrusions specifically remains unconfirmed.(Citation: Dragos Water Under Attack)
MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.