THIS WEEK’S SIGNAL
A Geopolitical Actor, a Civilian Resource, and No Battlefield
“Plant personnel immediately noticed the change in dosing amounts and corrected the issue.”
Recently, a water treatment plant in Braham, Minnesota, a municipal system serving 1,789 people, went offline, and residents were asked to keep water use down until treatment resumed. Across 26 and 27 July 2026, a coordinated cyberattack reached the operational technology of more than 30 Minnesota community water systems, Braham among them. The count is consistent across what has been reported, but not formally documented in any agency report thus far.
Within three days the United States Federal Bureau of Investigation (FBI) held reports from utilities in at least seven states. Reported activity reached at least 12 states by 6 August, still pending final confirmation. The attack methods match a wider campaign that federal agencies formally assess as Iranian-affiliated. What changed in July is the nature of (potentially) national capability now pointed at municipal water systems. A foreign state capability testing a small municipality, at a location where conflict is nowhere in sight.
The division of responsibility for such incidents has been documented on paper for years. The United States Environmental Protection Agency (EPA), the White House and even the North Atlantic Treaty Organization (NATO) have defined their roles and limits. All of which were well documented and published before July this year.
When an attacker reaches inside a plant serving 1,789 people, which institution or authority is responsible for answering the attack? In the documents reviewed for this brief, it’s mostly an issue of scale, which leaves the attack surface open at small municipal levels. If we shift our thinking from capacity to respond to impact, the numbers are also revealing. Braham's own wellhead protection plan holds it. The plan records how much water the city stores and how much it pumped in a year. Those two figures decide how long the city holds out alone. Every municipal system has the same two figures, including yours. Whether anyone has ever turned this data into preparedness capacity is the question, and one we need to measure now, and not during a crisis.
What's inside this issue
How institutions like the EPA, the White House and NATO limit their roles and responsibilities, in their own words, and which gaps that patchwork of limits leaves for smaller municipalities.
The role of storage and consumption figures as days of buffer, so your continuity plan runs on usable water rather than estimated volume.
What the attackers switched off inside a plant, which alarms would have stayed silent, and who is available to defend small utilities.
INTELLIGENCE BY CRISIS LAB · ISSUE 005 · A GEOPOLITICAL ACTOR, A CIVILIAN RESOURCE, AND NO BATTLEFIELD
More than 30 Minnesota water systems were hit in a single coordinated attack in July, and for the smallest of them, the entire defense was a town's own public works crew.
This issue is sponsored by:
Pinnacle Performance Management
Turn Emergency Mgt. Work into Executable Projects
Every emergency manager knows the gap: a shelf of after-action reports, mitigation plans, and new initiatives that stall because no one runs them like projects.
The Project Management for Emergency Managers (PM4EM) workshop closes it. Led by seasoned practitioners with decades of experience in the field — 9/11, Superstorm Sandy, COVID-19 — it adapts proven project management methods to the work EM actually does: engaging stakeholders, updated plans, developing training and exercises, grant execution, and improvement plans you can prioritize, assign, and finish.
This fall's live online cohort runs September–October 2026 — four 3-hour Saturdays, small-group, immediately applicable, and well-suited to professional development hours and CEUs qualify for both CEM and PMP (application).
Companion resources: the book Riding the Wave: Applying Project Management Science in the Field of Emergency Management, PM4EM templates, and follow up 1on1 coaching.
Crisis Lab readers get $300 off: use code CRISISLAB300.
CURATED BRIEFINGS
Scope of hacks on U.S. water supply widens as evidence points to Iran
The New York Times · August 1, 2026
The intrusions that began in Minnesota now reach utilities in at least seven states, and federal investigators say the evidence increasingly points toward Tehran. A national attribution case built on municipal victims is exactly the seam this issue pulls at.
At least 12 states face cyberattacks on their water systems, sources say
ABC News · August 4, 2026
The reported footprint doubled in just over a week, and the FBI is urging utilities to pull controllers off the internet and rehearse running plants manually. That advice quietly assumes every utility has the staff to run by hand, a staffing gap the toolkit helps you price.
Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers (AA26-097A)
CISA, FBI, NSA, EPA, and partner agencies · updated July 22, 2026
The joint advisory behind the July warnings lays out how the campaign reaches internet-facing controllers, including a malicious project file at one victim that overrode the logic keeping operating parameters safe. This is the technical core of the third question above: the intrusion can disable the alarms along with the process.
AWWA urges expanded U.S. cybersecurity support, measures
American Water Works Association · August 5, 2026
The largest U.S. water association told Congress that utilities are “historically under-resourced” and asked for stronger federal support after the July attacks. When the sector's own lobby says small systems cannot carry this alone, the responsibility gap becomes a budget fight.
DEF CON hackers launch Water Watch Center to defend small water utilities
SiliconANGLE · August 10, 2026
The National Rural Water Association and DEF CON Franklin stood up a volunteer-backed watch center for utilities serving fewer than 10,000 people, 12 days after the Minnesota intrusions began. The newest protection for the smallest systems carries no legal authority and no deadline, which is the irony the edition ends on.
LOOK AHEAD
AFAC26 powered by INTERSCHUTZ 18-21 August 2026 · Melbourne, Australia.
Australasia's largest emergency-management and first-responder gathering opens tomorrow, built around multi-agency integration across fire, emergency management, and crisis response.
EPA water cybersecurity trainings August 19 (Cybersecurity Refresher) and August 26 (Water Cybersecurity Assessment Tool webinar) · online.
Hands-on federal sessions for utility operators, landing while the July intrusions are still under investigation.
IET Cyber Security for Critical Industries 2026 15-16 September 2026 · London, UK.
Two days on securing operational systems across critical industries.
Critical Infrastructure Protection & Resilience Europe (CIPRE) 2026 20-22 October 2026 · Brussels, Belgium.
Governments, operators, and agencies on securing Europe's critical infrastructure; early-bird rates close September 20.
THIS WEEK FROM CRISIS LAB
Course: NATO Crisis Management and Disaster Response Course (CMDR)
When a crisis cascades across borders, someone has to coordinate the response. Built in partnership with the NATO CMDR Center of Excellence, this course teaches you to do exactly that: lead civil-military responses during humanitarian and disaster relief operations, and build resilience against hybrid threats like cognitive warfare and corruption. You'll earn the official NATO CMDR certification plus 2.2 IACET CEUs upon completion. It’s fully online and self-paced, so it fits around the job you're already doing.
Podcast: Rethinking EM Part 1: From Resilient to Anti-Fragile with Todd De Voe
Is resilience enough, or should emergency management aim higher? In this episode of the Crisis Lab Podcast, we sat down with emergency management professional Todd DeVoe to dig into where the field is heading. We covered why community trust has to be built long before the disaster, why the profession needs its own body of research, and what it takes to move past resilience toward anti-fragility: systems that don't just survive a crisis but come out stronger.
Listen on Spotify, Apple Podcasts, or Crisis Lab
You’re missing something…and it might be a problem.
Right now, somewhere, a water plant is running on alarm logic nobody has checked. That is the nature of this work: the signals that matter rarely arrive as headlines, and they never arrive on schedule.
You're busy. The feed is endless, the reports are long, and the one document that would change your planning is usually the one you didn't have time to read. Crisis Lab's job is to close that gap. Every day, our team tracks events, reads the source documents, and talks with senior professionals across policy, security, defense, and crisis management, so what reaches you is already distilled: what happened, what it means, and what to watch next.
That's why we built Intelligence, and why we launched Intelligence+ for readers who need the full picture: every key judgment with its confidence level, the assessment behind it, and the toolkit that turns analysis into action.
You make the decisions. We make sure you make them with your eyes open.
INTERNATIONAL CAREER OPPORTUNITIES
Role | Apply |
Manager, Grants Finance & Compliance | |
Associate Information Analyst | |
Workforce Planning and Org Design Consultant | |
Inclusive Leadership Senior Officer | |
Migration Project Manager - UniField | |
Regional Senior Finance Officer |
Crisis Lab is the intelligence and education arm of Capacity Building International. Twice-monthly intelligence briefings for senior crisis management practitioners.