Critical Infrastructure Month: The Outage Doesn’t Care Why It Happened

In late July, the water treatment plant in Braham, Minnesota went offline overnight. The attack had shut down its operating controls, taking the well and treatment plant offline, and the city relied on the water held in its water tower until crews resolved the problem. Braham was among more than 30 Minnesota community water systems targeted in the same coordinated campaign. In Plymouth, communications at two water towers and several lift stations were affected, and crews kept running them manually. The mayor of Maple Plain declared a local state of emergency. Officials in multiple affected communities said drinking water stayed safe.

Nobody breached a fence. The FBI and EPA said utilities in at least seven states reported incidents involving internet-facing programmable logic controllers (PLCs), and later reporting put the count at 12 states. Federal warnings described the actors remotely changing controller IP addresses and passwords, causing utilities to lose monitoring and control, and CISA’s July 30 alert said the activity had forced some utilities to operate manually. The effects elsewhere were more visible: in Georgia, the Clayton County Water Authority issued a boil water advisory after its operational technology was briefly disrupted, and restored service within a few hours once testing confirmed the water was safe. No official attribution has been made. Anonymous U.S. officials have told news outlets they suspect Iran-linked actors, an assessment described as preliminary.

A cyber incident at a water plant is also a physical incident, and the next day it’s a continuity problem. November is CISA’s Critical Infrastructure Security and Resilience Month, and in each of the 16 sectors it covers, an outage looks the same whether the cause was digital, physical, or neither.

Three Causes, One Outcome

On a Saturday night in December 2022, gunfire hit two electrical substations about five miles apart in Moore County, North Carolina. Roughly 45,000 customers lost power at the peak, and it took about four days to restore it because the damaged equipment was large, vital, and had to be physically replaced and tested. It was a physical attack, not a cyber one, and the outage looked like every other power failure to hospitals, businesses, and households.

On July 19, 2024, a faulty content update from CrowdStrike crashed about 8.5 million Windows devices, according to Microsoft’s estimate. That was less than 1% of all Windows machines, yet it still halted airlines, forced healthcare organizations to cancel appointments, and disrupted government agencies. No attacker was involved. As Microsoft’s David Weston put it, the percentage was small, but the effects reflected how many critical services run on the same enterprise tools.

Then there’s Minnesota’s water systems, where the cause was a remote attacker, and the effect was a plant shutting down.

A bullet, a bad update, and a remote attacker arrive through different doors. The people running the service face the same situation either way: something they promised to deliver has stopped. A resilience program organized around who caused the outage, with one team for hackers, another for break-ins, and a third for accidents, is organized around the part of the problem that matters least at the moment of impact.

The Dependency Is the Attack Surface

The airport disruptions of September 2025 show how this plays out through a vendor. Ransomware hit Collins Aerospace’s MUSE software, which lets multiple airlines share check-in desks and boarding gates, and ENISA later confirmed it. Heathrow, Brussels, Berlin Brandenburg, and Dublin all saw disruption, and staff fell back on pen and paper to check passengers in and board flights. Brussels Airport canceled 140 of 276 scheduled outbound flights on the following Monday. Collins found that the attackers were still present after their first rebuild attempt, so it couldn’t immediately deliver a secure replacement.

The airports weren’t the target. The shared software was, and each airport inherited the incident from it, discovering that its continuity plan depended on a system it didn’t control.

In mid-October, the same pattern took on a physical form in France. Overnight on October 11–12, attackers hit refrigeration control systems made by the Danish manufacturer Danfoss at supermarkets operated by several unrelated chains. The retailers reported at least 300 Intermarché and Netto shops, more than 100 Cooperative U outlets, and 80 Carrefour supermarkets affected, although Danfoss described a limited number of systems. French media reported that the attackers forced defrost cycles and drove temperatures as high as about 50°C (122°F). The Paris prosecutor’s office opened an investigation into the damage, including food losses and fires, and affected stores had to throw out fresh and frozen stock. Danfoss said most of the affected equipment was legacy hardware that no longer receives security updates. No group has been identified, and the investigation is ongoing.

Those stores didn’t share an owner. They shared a supplier and, according to Danfoss, most of the equipment had stopped updating, which is the kind of dependency that rarely shows up on a risk register.

The same pattern appeared closer to home in July 2025, when a cyberattack on the City of Saint Paul disrupted online payments, internet access, and printing. Services like 911 kept running. Governor Walz still activated the Minnesota National Guard’s Cyber Protection Team because the incident’s magnitude and complexity exceeded the city’s response capacity. It was the first time Minnesota had deployed its cyber forces within the state, which says something about where a cyber incident can end up: a state calling in the National Guard.

Adversaries Are Planning for This

Convergence isn’t something that happens to organizations by accident. In a February 2024 advisory, CISA and its partners warned that the PRC-sponsored group Volt Typhoon had compromised organizations in communications, energy, transportation, and water, and had maintained access in some victim IT environments for at least five years. CISA assessed with high confidence that the intent was to move into operational technology and disrupt functions if geopolitical tensions escalated.

That’s a cyber campaign whose purpose is physical, and it’s staged in advance so that a decision made elsewhere can turn into a blackout or a shutdown. Planning for it as an IT matter alone means the organization’s backup plan was written by the wrong people.

The Org Chart Is the Real Gap

In many organizations, the cyber team reports into one part of the structure, physical security and facilities sit in another, and business continuity lives in a third, often as a binder reviewed once a year. Each group keeps its own risk register, runs its own exercises, and uses its own vocabulary for the same event. When an incident crosses the lines, no one owns the whole thing, and the first hour goes to working out who should be in the room.

Where operations held up in the incidents above, it was because of a fallback that didn’t depend on the failed system. Braham leaned on its water tower. Plymouth kept its lift stations running manually, and the New Jersey utilities that lost remote monitoring shifted to manual operations. Airports reached for pen and paper. None of that comes from a security tool. It comes from continuity planning that assumed the technology would fail, and from someone knowing how to do the work without it.

What to Do This November

Map by service, not by threat. Pick the five or ten services your organization can’t afford to lose and write down everything each one depends on: the control systems, the network paths, the facilities, the vendors, the people, and the power. The result is a map of where cyber, physical, and continuity risk are the same risk.

Find out what’s exposed. The guidance that followed the water attacks was to disconnect PLCs from the internet, run any remote access through a VPN or gateway device, and keep controllers’ physical mode switches in the “Run” position. Ask whoever runs your operational technology a plain question: which devices can be reached from the open internet right now, which of them the manufacturer no longer updates, and who knows?

Practice the manual fallback. If a system fails, can the work continue without it, for how long, and who knows how? Run the drill with the people who would actually do it and write down what broke.

Run one exercise that crosses the lines. Put IT, operational technology, facilities, physical security, business continuity, communications, and a key vendor in the same room with a scenario that doesn’t say whether the cause was digital or physical. The gaps show up in the first twenty minutes.

Name one owner for the whole event. Decide in advance who has the authority to make the call when the incident spans several teams and make sure everyone else knows it.

Ask your vendors the Collins question. If a shared platform you rely on went down for a week, what would your operation do? If the answer is “wait,” that’s a risk-register entry.

Plan for the Outage

The operators in Braham didn’t have time to sort the problem into a category. The plant was offline, and what mattered was the water in the tower and the crews who knew what to do next. Bullets, bad updates, and remote attackers all end up at the same place: a service people depend on has stopped, and someone must decide what happens next.

That’s the case for treating cyber, physical, and continuity planning as one discipline, and November is a good time to start. Pick one critical service, map what it depends on, and ask what happens when any one of those dependencies fails, whatever the reason. The answer will show you where your plans stop overlapping.

The UMSA community works across all of these fields, and the conversation continues at Secure360 on May 12–13, 2027, at Mystic Lake Center in Prior Lake. If your organization has a story about a crossover incident, a joint exercise that found a gap, or a fallback that held, we’d like to hear it.

Sources consulted: CISA — Critical Infrastructure Security and Resilience Month, Valley News Live — Cyberattack hits more than 30 Minnesota community water systems, The Hacker News — Coordinated Cyberattack Targets 30+ Minnesota Water Systems, Cybersecurity Dive — Authorities investigating a coordinated cyberattack against Minnesota water systems, Cybersecurity Dive — What we know so far about the hacking campaign against US water systems, SecurityWeek — Dozens of Minnesota Water Utilities Targeted in Coordinated OT Attacks, BleepingComputer — CISA warns of cyberattacks disrupting U.S. water utilities, ABC News — Investigators probe Iran connection to Minnesota water system hacks, Al Jazeera — US authorities probe cyberattack on water systems in Minnesota, CBS News — Hackers turn up the heat in refrigerators at hundreds of supermarkets in France, Al Jazeera — Hundreds of supermarkets in France hit by “unprecedented” cyberattack, Malwarebytes — Hackers heat up supermarket fridges, spoiling food across France, NBC News — Power restored after gunfire led to massive outages in North Carolina, TechTarget — Microsoft: Faulty CrowdStrike update affected 8.5M devices, TechRepublic — Ransomware attack disrupted airports across Europe, KTTC — Why is the National Guard responding to Minnesota’s cyberattack?, TechTarget — CISA: Volt Typhoon had access to some U.S. targets for 5 years