Data Breaches

Minot Water Treatment Plant Targeted in Ransomware Attack; City Confirms Water Supply Remains Safe

The CyberSignal

The CyberSignal

— 2 min read
Editorial illustration of a water tower protected by a digital shield deflecting a red ransomware lightning bolt, symbolizing the contained cyberattack on Minot's water treatment plant.

The City of Minot has confirmed that its water treatment plant was the target of a ransomware attack earlier this week, marking the latest in a string of cyber intrusions aimed at critical U.S. water infrastructure. While the incident forced the isolation of several municipal servers, city officials and the FBI have moved to reassure the public that the safety and quality of the water supply were never compromised.

Swift Isolation and Incident Response

The attack was first detected on March 31, when IT staff noticed unauthorized encryption activity on a server utilized by the water treatment facility. The city’s technical team acted immediately to disconnect the affected systems from the broader municipal network, successfully preventing the malware from spreading to the Industrial Control Systems (ICS) that manage water chemistry and distribution.

Minot City Manager Harold Stewart addressed the public on April 2, stating that the plant’s operational technology (OT) remains under manual control or is running on secured, isolated backups. "Our redundancy protocols functioned exactly as designed," Stewart noted. "At no point did the hackers have the ability to alter the chemical composition of the water or disrupt the flow to our residents."

Federal Investigation and Attribution

The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) have joined the investigation to determine the origin of the attack and the specific ransomware strain involved. While no group has yet claimed responsibility the incident follows a pattern of opportunistic attacks on smaller municipal utilities that may lack the robust cyber defenses of larger metropolitan areas.

The City of Minot has not disclosed whether a ransom demand was made or if any data was exfiltrated during the breach. However, the city is currently conducting a full forensic audit of its administrative servers to ensure no PII (Personally Identifiable Information) of utility customers was accessed.

A Growing National Threat to Water Systems

The Minot attack underscores a growing national security concern. In 2026, EPA and CISA officials have repeatedly warned that the water sector remains "target-rich and resource-poor." Unlike the power grid, the U.S. water system is highly decentralized, consisting of thousands of local entities that are increasingly vulnerable to state-sponsored actors and financially motivated cybercriminals alike.

Primary Intel & Reports: KFYR-TV, Minot Daily News, The Record, MSN/Dakota News Network

The CyberSignal Analysis

The Minot incident highlights the critical importance of Network Segmentation in protecting life-sustaining infrastructure.

  • IT/OT Convergence Risks: This attack reached the facility's "business" side (IT) but was stopped before hitting the "valves and pumps" side (OT). For CISOs, this is a validation of the Purdue Model for ICS security. If your administrative emails and your chemical dosing controllers sit on the same flat network, a single phishing link could lead to a public health crisis.
  • Manual Overrides as a Fail-Safe: The ability of Minot staff to maintain operations manually is a core tenet of Cyber Resilience. As systems become more automated, the "lost art" of manual operation must be preserved as the ultimate fallback during a digital blackout.
  • The "Small Town" Target: Attackers are moving away from hardened federal targets toward municipalities where "security through obscurity" is no longer a viable defense. Regional utilities must prioritize Multi-Factor Authentication (MFA) and Endpoint Detection and Response (EDR) to harden the perimeter against these common ransomware vectors.

Read more