Cyberattacks targeting municipal water systems have been reported in at least seven states, prompting the FBI and the Environmental Protection Agency to warn utilities nationwide that hackers are trying to disrupt critical water infrastructure.
National Warning
In a public service announcement, the agencies said water and wastewater utilities have reported incidents to the FBI, with some malicious activity degrading water operations. The announcement does not name the states, but the federal Cybersecurity and Infrastructure Security Agency said in a separate alert that some larger attacks on water infrastructure had “resulted in boil water notices and sustained manual operations.”
A spokesperson for Minnesota’s information technology services agency said there was no indication the breaches contaminated any municipal water supplies. The federal advisory calls on system operators to remove programmable logical controllers from direct internet exposure by putting them behind secure gateways and firewalls; use strong passwords; and limit communications between authorized control system devices through access control lists.
Minnesota Breach
The breach in Minnesota happened just days after US officials publicly warned that Iran-backed hackers were targeting the nation’s critical infrastructure amid the escalating military conflict between Washington and Tehran. Minnesota officials and the US government have not publicly attributed the malicious activity in the state to a specific actor.
President Donald Trump, speaking to reporters, blamed Minnesota’s leaders and Gov. Tim Walz, saying, “I think I blame it on Minnesota because they’re grossly incompetent.” Walz responded, saying Trump knows exactly who is responsible for the attack and that other states were hit too.
The FBI and EPA advisory focused less on attribution than on the tactics used in the attacks. The federal advisory said the malicious cyber actors targeted specific brands of control systems used by municipal water utilities, though the FBI and the EPA urged operators of all systems to take precautions.
Original reporting: NBC4 Los Angeles — read the source article.
