Over the last weekend of July, someone launched what Minnesota officials are calling a coordinated cyberattack against the technology running more than 30 community water systems across the state. In the small town of Braham, the attackers shut down the operating controls — and with them, the well and the water treatment plant. Other towns lost communications to water towers and pumping stations or watched automated controls misbehave. The state activated a full cybersecurity response; one city declared a local state of emergency. Officials have not said who was responsible, and the investigation is ongoing.
Here’s the remarkable part, and the reason this story belongs on a small-business blog: the water stayed on. No town had to tell residents their water was unsafe. Braham’s plant was back online in about three hours. And the difference, in town after town, came down to one unglamorous thing: when the automation died, people knew how to run things by hand.
What happened, at a glance
| When | Sunday and Monday, July 26-27, 2026 |
| What was hit | The operational technology — the computerized controls — at more than 30 Minnesota community water and wastewater systems |
| The worst of it | Braham’s plant went fully offline after attackers shut down its operating controls; residents were briefly asked to minimize water use |
| Elsewhere | Plymouth lost cellular communications to two water towers and multiple wastewater stations and ran them manually; South St. Paul and Maple Plain saw automated controls affected but kept services running; Maple Plain declared a local emergency to organize its response |
| The outcome | No drinking-water advisories anywhere; Braham restored in roughly three hours by crews working hands-on |
| Who did it | Officials have not said; state, federal, and private-sector partners are investigating |
Small towns, small teams, critical systems
Notice who got attacked here. Not a federal agency, not a giant metropolitan utility — towns like Braham, population a couple thousand, whose “IT department” is a handful of people wearing several hats. If your reaction is “why would anyone bother attacking a tiny water plant?”, update that instinct, because it’s the same one that gets small businesses hurt. Attackers went after thirty-plus small operations at once precisely because small operations are numerous, automated, and lightly defended. Small has never meant unnoticed — and in the age of automated scanning, it especially doesn’t now.
And look at what was attacked: not data, but operations. The controls that make the physical business run. Every modern small business has its own version of this — the point-of-sale, the booking system, the shop-floor machine with a computer inside, the thermostats and door locks and cameras, the cloud service that everything depends on. The Minnesota attack is what it looks like when someone goes after the running of the business rather than its files.
The one thing the survivors had in common
The towns that shrugged this off were the ones that could fall back to manual. Plymouth’s crews ran their towers and stations by hand. Braham’s crews drove out and restored the plant hands-on. Federal guidance issued in the aftermath says the same thing in official language: isolate and prepare your vital systems so critical service continues even when the technology around it is under attack. In plain English — when the computers stop, the business shouldn’t.
Your continuity questions, borrowed from the water plants
- If your key system went dark right now, what happens? Could you take payments, serve customers, and run the day — even clumsily — or does the business simply stop?
- Does anyone know the manual way? Braham’s water flowed because crews knew how to run a plant hands-on. Is the manual version of your business written down anywhere — or does it live in one person’s head?
- Where is your data if the systems die? Operations came back in hours partly because nothing essential was lost. If your systems went down hard, are your records, files, and configurations safely backed up somewhere the attack can’t reach — and how old is the newest copy?
- What’s connected that doesn’t need to be? Plymouth’s trouble traveled over cellular links to remote equipment. Every remotely reachable device is convenience and exposure in the same box — worth knowing which of yours actually need to be reachable at all.
The takeaway in one line: the attack you can’t prevent is survivable if you’ve decided, in advance, how the business runs without its computers — and where its data lives when they come back. Thirty-plus water systems just passed that test in public. Most small businesses have never taken it.
Take the test before someone gives it to you
Our environment review walks your business through exactly this, in plain language: what’s connected and exposed, what the single points of failure are, what the manual fallback looks like, and whether your data is protected the way you assume it is — including making sure backups exist somewhere an attacker can’t touch, with private cloud backup and up to hourly snapshots for the businesses we manage. The Minnesota towns got their test on a Sunday night without warning and passed it with buckets of hands-on effort. The better version is knowing your answers on a quiet Tuesday, with coffee, before anyone forces the question.
Sources: Minnesota IT Services; city statements from Braham, Plymouth, South St. Paul, and Maple Plain; BleepingComputer; SecurityWeek; The Hacker News; FOX 9; CISA “CI Fortify” guidance, July 2026.
