A water treatment facility in northern North Dakota was recently targeted in a ransomware attack, prompting operators to temporarily switch to manual monitoring of system gauges.

Officials from the City of Minot confirmed on Wednesday that despite the cyber incident, the region’s drinking water remained secure. In a letter submitted to the FBI, staff reported detecting the ransomware on March 14, which led to the use of “manual procedures” for approximately 16 hours until a replacement server was installed.

Jennifer Kleen, communications and engagement manager for Minot, explained that the ransomware affected the plant’s SCADA system, “which is kind of like a dashboard system. It brings all of those gauge readings to one spot.” While manual gauge checks are part of standard practice, employees had to perform them more frequently during the system outage.

The Minot water treatment plant supplies water to the city—home to around 50,000 residents—and surrounding communities under the Northwest Area Water Supply network, reaching a total of about 80,000 users.

Authorities discovered a ransom note on the compromised SCADA server, but it did not specify any payment demand. No ransom was paid, and officials have not identified the group responsible for the attack.

Recovery efforts are nearly complete, with the facility currently relying on an older server while preparing a new system. The city noted that the incident has created “opportunities for training exercises, improved communication, and preventative system design.” In a local television interview, City Manager Tom Joyce acknowledged that he would have convened a “crisis action team” earlier, including key officials, “to ensure we’re all on the same page right away.”

Cyber threats to water utilities have been on the rise, with groups linked to countries like China and Iran frequently targeting such infrastructure. A 2024 report by the Environmental Protection Agency’s Office of Inspector General highlighted multiple vulnerabilities across U.S. water systems. Out of more than 1,000 systems assessed—serving 193 million people—97 were found to have critical or high-risk vulnerabilities, while 211 had moderate to low-risk issues, including “having externally visible open portals.”

Government bodies at both federal and state levels have been pushing for stronger cybersecurity measures in the water sector. Proposed legislation aims to help smaller utilities modernize their systems and meet updated security standards. Meanwhile, New York recently introduced “first-in-nation” cybersecurity regulations, supported by funding for water treatment facilities.

However, experts warn that implementing such upgrades can take significant time—often months or even years—leaving systems exposed in the interim. Recent geopolitical tensions, including military actions involving the United States and Israel against Iran, have further heightened concerns. Information-sharing organizations, including the Water Information Sharing and Analysis Center, recently cautioned about a “highly volatile” threat landscape, warning of possible “increased cyberattacks from Iranian state-sponsored actors, hacktivists, and cybercriminal groups aligned with Iran.”