Cyberattacks Disrupt Water Systems Across U.S.

On July 30, a water tower in Plymouth, Minnesota, stood as a silent witness to a cyberattack targeting over 30 water systems in the state. Braham, Minnesota, experienced a significant disruption, forcing local water operators to rely on backup supplies after a pump failure. This breach was part of a coordinated attack against industrial technology nationwide.

Authorities suspect Iran’s involvement, continuing a history of cyber-attacks on U.S. infrastructure. Such attacks often aim to steal data, cause disruptions, or ransom critical resources like water and power. Nate George, Braham’s mayor, emphasized the vulnerability of internet access points and technology, noting that the hackers had exploited these, provoking anxiety rather than tackling specific towns.

Rob Lee, CEO of Dragos, highlighted the unprecedented scope of the attack, noting targets beyond the water sector also faced disruptions. This attack underscores the need for secure systems across critical infrastructure operators.

Between July 26 and July 28, various Minnesota communities reported water plant issues, leading to emergency measures, including a boil water advisory in Clayton County, Georgia. Suspected to be part of a larger nationwide attack, WaterISAC quickly convened a call for its members, sharing intelligence from the federal government. The FBI confirmed attacks across at least seven states, indicating extensive impact.

The U.S. government has yet to establish culpability for these attacks, but similar incidents have involved nation-states, notably Russia against Ukrainian power grids and Iranian-linked groups targeting U.S. facilities. Recent cybersecurity advisories warn against Iranian-linked hackers exploiting vulnerabilities in industrial machines.

SonicWall’s Michael Crean noted a spike in internet scanning for vulnerable devices, reminiscent of an attack on Stryker’s medical technology. Despite no official claims, intelligence suggests links to the Iranian Revolutionary Guard Corps. Jake Braun, a former White House national cyber director, believes Iran aims to demonstrate its ability to disrupt essential services like water and challenge trust in U.S. government capabilities.

Local communities, like those in Braham, strive to safeguard against these threats. Chris Hughes from Cavendish, Vermont, participated in a cybersecurity program, emphasizing potential hacker damage from systems connected to the internet. Brandon Huston from Minnesota’s Wastewater Operators Association opts out of internet-connected systems due to security concerns and costs.

Patrick Gillespie explains challenges in securing aging operational technology in vital sectors, like the water industry. Searight, a former chief information officer, notes that outdated machines are hard to update and secure, risking health impacts and environmental damage.

Mitigation measures are imperative as attackers target vulnerable devices with default credentials. Effective strategies include removing exposed devices from the internet, changing passwords, disconnecting them from business networks, and setting up strong access controls.

National security officials have warned against threats from stealthy actors like Volt Typhoon, which embed within U.S. infrastructure, posing risks similar to those anticipated by Mayor George. He reflects on military strategies potentially aiming to incite panic or distraction.

The recent attacks urge proactive measures for potential future escalations. Kevin Morley from AWWA stresses robust information sharing to mitigate consequences, urging federal investment in cybersecurity. WaterISAC seeks new members to access intelligence early, while Braun and Project Franklin aim to assist small utilities. Innovative projects at Vanderbilt University, funded by DARPA, focus on real-time AI defense for water infrastructure.

Despite nationwide efforts, resource constraints hinder adequate cybersecurity. Reduced federal workforce impacts collaboration, intelligence sharing, and technical support crucial for protecting essential services.

California’s emergency response office warns against complacency, acknowledging threats from cuts to cybersecurity workforce and programs. Braun argues federal support is vital for sustained security initiatives.

Lee warns only comprehensive leadership can address these vulnerabilities and mobilize public investment in modernizing infrastructure to counter global cyber threats.