Madeleine Rivera, a national correspondent, reports on a cyberattack linked to Iran that has targeted community water systems in Minnesota and at least six other states. This attack has drawn attention due to the targeting of critical infrastructure, which has been warned by federal agencies such as the FBI, CISA, and the EPA.
Community water systems often go unnoticed as part of daily routines. People expect clean water when turning on the tap, which makes the consequences of such cyber threats particularly unsettling. These attacks were sophisticated and coordinated, hitting operational technology at over 30 community water systems between July 26 and July 27. Minnesota IT Services (MNIT) activated its cybersecurity response, enlisting federal assistance.
One plant went offline temporarily, while others faced issues with automated controls or communication equipment. Manual operations or backup procedures were used to maintain services. Fortunately, there were no active requests from the state for residents to change their water usage.
The FBI confirmed that utility companies in seven states suffered effects from the cyberattack, affecting operations.
This incident raises pressing concerns for towns across the country. Many are questioning their ability to operate if hackers access their control systems.
Iranian Hackers Suspected
Federal officials have yet to definitively identify the attackers. However, reports suggest Iranian hackers are likely behind the Minnesotan attacks. Despite preliminary suspicions, President Trump expressed skepticism regarding Iran’s involvement. Investigators stress that evidence-gathering is ongoing, and the true identity of the attackers might be cloaked.
CISA had previously warned of threats by Iran-affiliated hackers targeting internet-exposed programmable logic controllers, which manage machinery crucial to water systems and other infrastructure. While federal agencies have not directly linked these warnings to the Minnesota incidents, the attacks highlight vulnerabilities in infrastructure systems.
Threat to U.S. Communities
Such cyberattacks can occur in any state. With around 170,000 drinking water and wastewater systems in the U.S., even minor disruptions can heighten fear. Many systems rely on internet-enabled technology for remote monitoring, but unsecured connections could invite attacks.
- Smaller communities face the greatest risks due to varying cybersecurity capabilities and outdated technology.
- Federal studies have shown wide inconsistencies in security measures across utilities, challenging smaller towns with limited budgets.
While larger utilities may employ dedicated security teams, smaller ones rely on plant operators who juggle various roles, leaving them less able to monitor cyber activities continuously.
Foreign hackers have previously exploited weak points in American infrastructure. Upgrading antiquated technology and securing connections are critical steps toward improving security.
Impact on Water Quality
A cyberattack doesn’t automatically mean water contamination. Despite the attacks, Minnesota officials reported no impact on water quality. In serious scenarios, hackers could potentially disrupt treatment or damage equipment.
Operations continued manually in Minnesota, serving as a safety net. Such options are vital but require training and testing to ensure they function correctly if needed.
CISA’s Security Recommendations
On July 28, CISA issued international guidance titled “CI Fortify,” advising the isolation of vital systems from untrusted networks. This separation helps maintain essential operations even if other parts are compromised.
For water utilities, CISA recommends avoiding unnecessary internet exposure and employing security controls when remote access is needed. Changing default passwords and assigning individual credentials are essential measures.
EPA inspections have revealed security lapses, with many systems failing federal risk assessment or emergency planning requirements. These findings indicate the need for more robust digital security measures.
Community Response to Cyberattacks
- Seek official guidance from local authorities and avoid unverified information.
- Keep using water normally unless otherwise directed.
- Ensure emergency alerts are active on your devices.
- Maintain an emergency water supply for disruptions.
- Be cautious of scams during outages, verifying utility communications through official sources.
Missouri efficiently managed the Minnesota cyberattack situation without compromising water safety through quick restorations and reliance on manual procedures. This incident highlights the vulnerabilities present in smaller utilities across the nation. It should be a wake-up call for local and state governments to assess the cybersecurity of their water systems.