Key facts
- At least seven US states have reported cyberattacks on water utilities to the FBI since July 27.
- The attacks involve malicious actors remotely accessing internet-facing computers, altering settings and passwords.
- Some attacks have weakened operators' ability to monitor and control equipment, leading to disruptions like loss of water pressure.
- Braham, Minnesota, experienced a shutdown of its water treatment controls, temporarily relying on stored water.
- Federal agencies are advising water utilities to disconnect certain internet-connected devices (PLCs) from public access.
Government officials are issuing warnings about a significant increase in cyberattacks targeting water utilities across the United States. Since July 27, at least seven states have reported incidents to the FBI, which has identified the perpetrators only as "malicious cyber actors." These actors have gained remote access to internet-facing computers used by water utilities, altering critical settings, IP addresses, and passwords. In some instances, these intrusions have compromised the operators' ability to monitor and control their equipment, leading to real-world consequences such as loss of water pressure and flooding.
Experts have long sounded alarms about the cybersecurity vulnerabilities within US water systems and other critical infrastructure. The FBI and other federal agencies previously warned of Iran-affiliated cyber threats that could target such systems. The impact of these attacks can vary widely, depending on the specific device compromised and the operational complexity of the utility. For example, an attack could affect a pump, a motor, or a simple tank-level log.
City officials in Braham, Minnesota, reported that a cyberattack disrupted controls for their well and water treatment plant, forcing a temporary reliance on stored water. Minnesota officials noted over 30 community water systems were targeted recently, while Michigan reported nine systems affected. Connecting operational technology, such as Programmable Logic Controllers (PLCs), to the internet creates significant vulnerabilities, according to cybersecurity experts. These PLCs manage automated functions, and hackers could disable alerts or alter operational parameters.
The potential disruptions extend beyond water service, impacting businesses, hospitals, and emergency response capabilities. Cybersecurity experts emphasize the need for improved protections, though establishing universal standards is challenging due to the diverse nature of water utilities. The American Water Works Association advocates for developing nationwide minimum cybersecurity requirements. Experts stress that strengthening cybersecurity is a matter of national security and resilience, urging utilities to act proactively before a severe attack necessitates it.