U.S. authorities are investigating a data breach at Micro-Comm, a small company in Olathe, Kansas, that supplies technology for water utilities. The FBI confirmed its involvement in the investigation, which highlights ongoing cybersecurity threats to the nation's critical infrastructure.
The breach occurred around July 31, according to Micro-Comm co-owner Jim Cote, and was claimed by a ransomware group known as Barracuda. The group posted approximately 850,000 files, totaling around 644 gigabytes of data, on August 6. Micro-Comm manufactures programmable logic controllers (PLCs), devices used to manage machinery in critical infrastructure networks, including wastewater processing facilities.
While Micro-Comm stated that the released files did not contain sensitive information like user passwords or data enabling remote access, and that any sensitive information was encrypted, the incident comes amid a series of cyberattacks targeting PLCs across the U.S.
These broader attacks, which began in July, have affected water facilities in Minnesota and at least six other states. Cybersecurity experts believe these incidents are part of a sustained campaign by actors linked to Iran. The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) had issued warnings on July 30 about hackers targeting PLCs manufactured by Rockwell Automation, Schneider Electric, and Siemens. CISA noted on August 19 that attackers were leveraging artificial intelligence to facilitate attacks on Siemens equipment.
Micro-Comm's leadership has emphasized that its breach is not related to the widespread water system hacks being reported. The FBI has indicated to the company that the attack was opportunistic and not specifically targeted at Micro-Comm. Nonetheless, the company advised its customers to change their passwords as a precautionary measure.
Internet monitoring firm Censys identified that roughly 200 of Micro-Comm's SCADAview CSX systems are accessible via the internet. A list of the leaked files, compiled by cybercrime research platform eCrime.ch, includes references to specific government customers, such as local municipalities and a U.S. military facility, alongside employee names and product diagrams.
Tom Hegel, a senior threat researcher at SentinelOne, commented that while the data release does not indicate any immediate operational compromise of water systems, the information could potentially aid hackers in future operations. The FBI's Kansas City field office confirmed its coordination with other law enforcement agencies on the Micro-Comm investigation.