Cyberattacks on US Water Systems Expand to 12 States
Cyberattacks on water systems have expanded to at least 12 states, with South Dakota and Georgia announcing incidents, allegedly linked to Iranian hackers. The scope of the campaign continues to grow, with federal agencies warning of a significant increase in cyber threat actors targeting programmable logic controllers (PLCs) at water utilities.
Incidents Reported in Multiple States
State officials in Minnesota were the first to report incidents last week, and the FBI previously said that since July 27, water and wastewater utilities in at least seven states had reported attacks that impacted operations. ABC News reported that facilities in at least 12 states are now remediating cyberattacks, including several in Michigan.
On Monday, Georgia’s Clayton County Water Authority confirmed that it “experienced a temporary disruption affecting a portion of its operational systems and water service in parts of north Clayton County.” The authority said it is investigating the cyber activity and that it was forced to issue a precautionary boil water advisory in response to the attack.
CISA Warns of Increased Threat
The Cybersecurity and Infrastructure Security Agency (CISA) released an advisory two weeks ago warning that Iranian state hackers are targeting internet-connected operational technology devices, including PLCs. A follow-up advisory last week from CISA said attacks on PLCs have “resulted in boil water notices and sustained manual operations.”
CISA Acting Director Nick Andersen told Recorded Future News, “CISA is currently observing a significant increase in cyber threat actors targeting programmable logic controllers (PLC) at water utilities. We urge critical infrastructure owners and operators to remove publicly exposed PLCs and other operational technology from the internet as soon as possible.”
FBI Investigates Incidents
An FBI spokesperson said it is working with other agencies to protect utilities against the intruders. The incidents bear similar hallmarks, the FBI said. After the devices are accessed remotely, the actors change the passwords and remove the ability of officials to monitor and control the devices.
The agency urged organizations to remove PLCs from the internet, set up firewalls, create unique passwords, and only allow communication between expected control devices. “Operational effects reported to the FBI have included loss of pressure and flooding. Pressure loss in water systems could potentially allow untreated ground water to seep into pipes,” the FBI explained.
Concerns Over Water Utilities
Water utilities have been a source of concern for federal cyber defenders for years due to the lack of funding available to protect systems that could have an inordinate impact on a local population in the event of a cyberattack.
Jake Braun, a former cyber official in the Biden administration, told Recorded Future News that the attacks are a significant shot across the bow by Iran because of three potential impacts. Civilian water utilities support military installations across the U.S. and many also underpin data centers, particularly those that were targeted in Minnesota.
Braun also noted the irony of Iranians specifically targeting PLCs after previous incidents where U.S. and Israeli officials allegedly used the Stuxnet worm to cause damage to Iran’s nuclear program by targeting the same operation technology.
They can shut off the water for our military, they can shut off the water for our economy, in particular our AI dominance, and they can undermine trust in our government to provide the most basic life-giving services. That's really what's at the core of this.
The attacks on water systems have raised concerns over the vulnerability of critical infrastructure and the potential consequences of a successful cyberattack.
Source: The Record