In this paper, we present a fixed-order set-valued observer for linear discrete-time bounded-error systems that simultaneously finds bounded sets of compatible states and unknown inputs that are optimal in the minimum H∞-norm sense, i.e., with minimum average power amplification. We also analyze the necessary and sufficient conditions for the stability of the observer and its connection to a system property known as strong detectability. Next, we show that the proposed set-valued observer can be used for attack-resilient estimation of state and attack signals when cyber-physical systems are subject to false data injection attacks on both actuator and sensor signals. Moreover, we discuss the implication of strong detectability on resilient state estimation and attack identification. Finally, the effectiveness of our set-valued observer is demonstrated in simulation, including on an IEEE 14-bus electric power system.