In a statement, MNIT said it is working closely with federal, state, local, Tribal and private-sector partners to investigate the incident, support affected communities and strengthen the security of Minnesota's critical infrastructure.

As cybersecurity teams continue to assess the impact of the attack, MNIT said it is sharing threat intelligence, providing guidance on response efforts and cybersecurity best practices, and assisting affected water utilities in containing, investigating and remediating the incident.

The agency is coordinating its response with the Minnesota Department of Public Safety, the Bureau of Criminal Apprehension's Minnesota Fusion Center, the Minnesota Department of Health, the Minnesota Pollution Control Agency, the Cybersecurity and Infrastructure Security Agency (CISA), the U.S. Environmental Protection Agency (EPA), the Federal Bureau of Investigation (FBI) and local water utilities.

MNIT said the investigation remains active as authorities continue to assess the extent of the cyberattack and its impact on affected systems.

"Cyberattacks against critical infrastructure require a coordinated, whole-of-government response," said John Israel, MNIT Assistant Commissioner and Minnesota Chief Information Security Officer.

"MNIT is working side by side with our partners to share intelligence, support affected communities and help utilities restore operations safely while strengthening defenses against future attacks. This incident demonstrates why Minnesota has invested in strong cybersecurity capabilities and partnerships. Our response worked as intended, enabling agencies at every level of government to rapidly coordinate, contain the incident and help prevent more serious impacts to critical services," he added.