Automation Supports Operations. People Deliver Resilience.
The cyberattack disrupted automated controls, but it did not stop wastewater operations. The incident demonstrated that while technology makes modern utility management possible, resilience ultimately depends on the people who adapt when systems are disrupted.
On July 26-27, 2026, a coordinated cyberattack targeted water and wastewater utilities across multiple states, disrupting monitoring and control of critical infrastructure systems. Hackers reportedly gained access to internet-connected PLCs, causing some utilities to lose visibility and automated control of key assets.
Public Works departments responded by deploying personnel into the field, manually operating equipment, and maintaining essential services until control systems could be restored. While the attack disrupted automation, it did not stop the mission of protecting public health and the environment. The incident was a reminder that infrastructure resilience depends not only on technology, but also on the people who operate it.
What the Data Reveals
The graph above shows sewer use from a residential area in Plymouth, Minnesota. Typical weekdays are shown in green. Typical weekends are shown in blue, and the day of the cyberattack – Monday, July 27th – is shown in red. What makes this graph remarkable is that it documents both the attack and the response.
Hackers disrupted automation. Operators kept wastewater moving.
At approximately 12:30 AM, the red curve drops below the normal weekday pattern as automated control of an upstream lift station was lost. The resulting decrease in sewer flow provides a visible operational signature of the cyberattack. As Public Works personnel mobilized and began manually operating affected lift stations, a distinctly different flow pattern emerged. The departures from the normal weekday diurnal curve are not signs of system failure. They are evidence of operators adapting in real time to keep wastewater moving despite the loss of automation. By approximately 6:00 PM, the threat had been contained at this lift station and automated control was restored, with no impact to public health or the environment.
More Than Flow Data
To me, the most interesting part of this graph is that it captures something larger than flow data. It captures resilience.
The hackers succeeded in disrupting automation. They did not stop operations. Behind every critical infrastructure system are people who understand it, adapt when conditions change, and ensure that essential services continue.
Automation makes day-to-day wastewater operations manageable, but resilience depends on the operators who step in when automation is compromised.
On July 27th, those people were the wastewater professionals of Public Works.
Well done.
Author: Kevin Enfinger P.E.
