Edina fortifies water system cybersecurity against federal threat warnings

Edina fortifies water system cybersecurity against federal threat warningsFollowing recent cyberattacks on municipal infrastructure, the City of Edina has disabled remote programming capabilities for its water and wastewater facilities while maintaining firewalled internet connectivity for operational monitoring.

Public Works Director Chad Millner confirmed Edina's water infrastructure experienced no breaches during recent cyberattacks on municipal systems.

The city has modified facility settings, requiring personnel to be physically present to edit programs controlling water and wastewater infrastructure.

Edina opted not to fully disconnect its programmable logic controllers (PLCs) from the internet to retain remote monitoring, alarm software, and compliance reporting capabilities.

The utility secures its wells, treatment plants, and lift stations using multi-factor authentication, firewalled VPNs, and physical intrusion alarms on doors and control cabinets.

During the August 5, 2026, City Council meeting, the City of Edina addressed heightened concerns over the cybersecurity of its municipal water and wastewater infrastructure following federal warnings regarding vulnerabilities in programmable logic controllers (PLCs). Public Works Director and City Engineer Chad Millner confirmed that Edina's wells, water treatment plants, and lift stations did not experience any cybersecurity breaches during recent attacks that targeted municipal systems, including a cited incident in nearby Plymouth. Addressing public concerns about whether the city should completely disconnect its PLCs from the internet to prevent hacking, Millner outlined the utility's current defensive posture and the operational trade-offs of going entirely offline. "The recent attacks were on specific ports on systems that were open to the internet, no firewall preventing outside connectivity to them," Millner told the council. In response, Edina has altered the settings at each of its water and wastewater facilities. Currently, no individual can edit the programs that control the infrastructure without being physically present at the facility. Furthermore, the city has fortified its physical security measures, including the installation of door and control cabinet intrusion alarms. If a cabinet is opened without proper credentials, alarms are triggered, and personnel are dispatched to investigate. Despite suggestions to fully disconnect the water system's PLCs from the internet, Millner explained that the utility relies on web connectivity for essential daily operations. The system utilizes secure connections via a firewalled virtual private network (VPN) and requires multi-factor authentication for remote access. According to Millner, severing the internet connection would cause the utility to lose remote access for operators monitoring the infrastructure, disable the alarm system software used to detect operational anomalies, and eliminate the ability to push daily, monthly, and yearly operating data to the city's reporting software. City staff indicated that both internal and external personnel monitor the system's cybersecurity. While current measures focus on securing remote access and physical assets, the council also discussed incorporating a dedicated technology and cybersecurity component into the city's comprehensive plan to ensure long-term protection of Edina's infrastructure.