Recently, a water treatment plant in Braham, Minnesota, a municipal system serving 1,789 people, went offline, and residents were asked to keep water use down until treatment resumed. Across 26 and 27 July 2026, a coordinated cyberattack reached the operational technology of more than 30 Minnesota community water systems, Braham among them. The count is consistent across what has been reported, but not formally documented in any agency report thus far.
Within three days, the United States Federal Bureau of Investigation (FBI) held reports from utilities in at least seven states. Reported activity reached at least 12 states by 6 August, still pending final confirmation. The attack methods match a wider campaign that federal agencies formally assess as Iranian-affiliated. What changed in July is the nature of (potentially) national capability now pointed at municipal water systems. A foreign state capability testing a small municipality, at a location where conflict is nowhere in sight.
The division of responsibility for such incidents has been documented on paper for years. The United States Environmental Protection Agency (EPA), the White House and even the North Atlantic Treaty Organization (NATO) have defined their roles and limits. All of which were well documented and published before July this year.
When an attacker reaches inside a plant serving 1,789 people, which institution or authority is responsible for answering the attack? In the documents reviewed for this brief, it’s mostly an issue of scale, which leaves the attack surface open at small municipal levels. If we shift our thinking from capacity to respond to impact, the numbers are also revealing. Braham's own wellhead protection plan holds it. The plan records how much water the city stores and how much it pumped in a year. Those two figures decide how long the city holds out alone. Every municipal system has the same two figures, including yours. Whether anyone has ever turned this data into preparedness capacity is the question, and one we need to measure now, and not during a crisis.
What we're reviewing in this issue
How institutions like the EPA, the White House and NATO limit their roles and responsibilities, in their own words, and which gaps that patchwork of limits leaves for smaller municipalities.
The role of storage and consumption figures as days of buffer, so your continuity plan runs on usable water rather than estimated volume.
What the attackers switched off inside a plant, which alarms would have stayed silent, and who is available to defend small utilities.
This analysis continues for paid subscribers.
Intelligence by Crisis Lab delivers a focused analytical brief, companion toolkit, and audio briefing every two weeks. Built for professionals who manage crisis, security, and resilience.
Get the Full Brief