The Plant Stopping Was the Alert.
More than 30 Minnesota water systems were targeted within roughly 48 hours.
“Too small to be a target” was never a security assessment. It was a budget assumption that had not been tested.
Braham, with a population of 1,769, lost control of its water treatment plant. Maple Plain declared a local state of emergency. Plymouth disconnected cellular equipment at its water towers and lift stations, forcing crews to operate them manually.
Braham only learned it had been compromised when the plant stopped.
On July 30, the FBI, EPA, and CISA issued guidance to the water sector. The agencies described attackers accessing internet-exposed controllers, changing passwords and IP addresses, and locking operators out of their own equipment.
Braham wasn't chosen because it was important. It was reached because it was exposed.
“Too small” describes a budget. It doesn't describe exposure.
Water Is Behind.
Electric utilities operate under mandatory cybersecurity standards. Water systems operate under a weaker model.
The America’s Water Infrastructure Act requires systems serving more than 3,300 people to assess their risks. Assess, not fix.
Stop Adding More. Start Evaluating.
The default answer is another sensor, dashboard, or feed.
Small teams with tight budgets can't manage another queue. Before adding more, evaluate what's already in place:
Does it detect real threats?
Does it help the operator understand what's happening?
Does it reduce investigation time?
Does it help the team act before operations are disrupted?
Detection that misses the behavior and ends in a queue isn't detection. it's a to-do list.
What We Built.
CrunchAtlas was built to help teams move at machine speed.
Instead of spending hours investigating alerts and network traffic, CrunchAtlas does the work for them.
It passively ingests network data, finds anomalous behavior and lateral movement, and delivers triaged cases with the investigation already done: what happened, what campaign it may be connected to, and what to do next.
Troubled Waters: Minnesota Cities Weather Cyber Attack — Governing, July 2026
Cyberattacks target several Minnesota water facilities, state authorities respond — FOX 9, July 2026
AWIA Section 2013: Risk and Resilience Assessments and Emergency Response Plans — U.S. EPA
CIP Standards — North American Electric Reliability Corporation
