Cyber actors lock out state governments from water systems in 12 states

Malicious cyber actors locked state governments out of water systems in at least a dozen states. There were no known impacts to drinking water in the affected communities, but the intrusions exposed weaknesses in systems that local governments rely on to keep water flowing and wastewater moving.

Federal agencies warned on July 30 that attackers were remotely reaching into internet-facing programmable logic controllers, the industrial devices that run critical utility equipment. The Federal Bureau of Investigation identified changing IP addresses and passwords and causing operational disruptions, and the Cybersecurity and Infrastructure Security Agency directed water and wastewater systems to protect operational technology against attacks targeting PLCs.

On August 6, cyberattacks on U.S. water systems had spread to at least a dozen states, with no widespread disruptions to water supplies or treatment. Earlier federal warnings had focused on seven states, including Minnesota and Michigan, and investigators were examining whether Iran was behind the wave. Later intelligence analysts strongly suspected Iran-backed hacker groups were responsible.

The pressure on utilities was already visible in Minnesota, where more than 30 water facilities had been breached before the federal warning went out. On July 29, the Environmental Protection Agency, CISA and WaterISAC held an urgent lightning brief on the incidents, and dozens of water systems, from small operators to large utilities, were affected.

On April 7, CISA issued a cyber advisory on Iranian-affiliated cyber actors exploiting PLCs. The advisory identified operational technology in water utilities as a repeated target.