Over two days in late July, a coordinated attack disrupted water and wastewater operations across more than 30 Minnesota communities — Braham's well and treatment plant shut down entirely, Plymouth disconnected cellular-connected water towers and lift stations, Maple Plain declared a local state of emergency. Drinking water quality was never affected and no boil-water advisories were issued, but the mechanism matters more than the outcome. Four days earlier CISA had expanded its advisory on Iranian-affiliated PLC targeting to cover Schneider Electric and Siemens alongside Rockwell, documented PLC project file theft for the first time, and described an FBI-observed case where malicious Add-On Instructions disabled safety shutdowns and alarms while operator displays were manipulated to show normal conditions. The central Rockwell authentication byp ...