Cyberattacks, most likely orchestrated by Iran, have compromised water and wastewater utilities in at least a dozen U.S. states, disrupting services in small towns and raising alarms about the security of the nation's aging infrastructure.
The attacks, which began impacting systems in Minnesota and quickly spread, led to temporary service outages, boil-water advisories, and localized flooding. While no major, long-term disruptions or public health crises were reported, the incidents underscore the vulnerability of water systems, many of which were built long before the digital age.
These systems, often managed by local authorities with limited IT resources, have increasingly been connected to the internet for remote monitoring and operation. This connectivity, while offering convenience, has exposed critical infrastructure to modern cybersecurity threats. Experts note that many of these systems rely on basic security measures, such as easily guessable passwords or no passwords at all, making them easy targets for malicious actors.
"We have more cybersecurity regulations for your credit card than we have for the nation’s water supply," said Joshua Corman, founder of the nonprofit I Am The Cavalry. He highlighted that approximately 97 percent of water systems are small and run by local agencies that often lack robust security protocols.
In a worst-case scenario, attackers could manipulate chemical levels in drinking water, open floodgates, or completely shut off water access. Such incidents have occurred on a smaller scale, including a Russian cyberattack on a Norwegian dam last year and an attempted poisoning of a water treatment plant in Florida in 2021.
The recent attacks have also drawn political commentary, with former President Donald Trump baselessly suggesting that Minnesota or its governor might be behind the disruptions, casting doubt on the Iranian cyberattack attribution. This occurred despite proposed budget cuts to the Cybersecurity and Infrastructure Security Agency (CISA) during his administration.
Jen Easterly, former head of CISA, stated that nation-state hackers exploit the jurisdictional boundaries between federal, state, and local responsibilities, often targeting less-resourced communities. "They search for the most vulnerable way to disrupt American life, and too often they find it in small communities that lack the resources to defend themselves," she wrote.
To mitigate these risks, experts recommend enhancing network monitoring for suspicious activity. Some suggest that the most effective solution for certain critical controls may be to disconnect them from the internet entirely if they cannot be adequately secured.
While the immediate impact of last week's attacks was limited, the incidents serve as a stark warning. Many water facilities, particularly in smaller municipalities, remain susceptible to cyber threats, necessitating greater investment in cybersecurity measures and updated infrastructure to protect essential services.
