Hacktivist

A coordinated cyber campaign in July 2026 targeted operational technology at more than 30 Minnesota community water systems and related facilities in at least seven U.S. states. Attackers accessed internet-facing Allen-Bradley MicroLogix 1100/1400 PLCs, changed device IP addresses and passwords to lock out operators, and modified ladder logic, causing loss of water pressure, flooding, and reliance on manual operations. The campaign shares technical characteristics with an Iranian-affiliated PLC-targeting operation documented in Joint Cybersecurity Advisory AA26-097A, but attribution remains unconfirmed. Concurrent pro-Russian hacktivist activity (NoName057(16) and Z-Pentest) targeted Canadian water systems, demonstrating that multiple actor types are exploiting exposed OT infrastructure using legitimate engineering tools rather than advanced ICS malware.