New Jersey and Alabama have joined the list of US states that confirmed their water and wastewater facilities have been targeted in a hacking campaign that started in late July.
At least 12 states have reportedly been hit, but not all have been identified. Minnesota was the first to confirm that over 30 water systems had their operational technology (OT) systems targeted.
Michigan, South Dakota, and Georgia later also confirmed being targeted.
The latest to join the list are New Jersey and Alabama. In New Jersey, Cape May and Woodbine water systems were targeted in cyberattacks on July 27, but officials said only phone systems were disrupted, according to Fox29.
WVTM13 reported that the Childersburg Water, Sewer and Gas system in Alabama was attacked on the same day. Hackers targeted industrial control systems (ICS), but the attack did not disrupt water services.
None of the water utilities or states that have come forward have reported significant impact — some shut down systems, but disruptions were limited — and they all informed citizens that drinking water is safe.
Wisconsin, Pennsylvania, and Washington have issued warnings to water utilities but have not confirmed attacks.
New York has not said whether its water utilities have been affected by the attacks, but officials have announced more than $9 million in grants to help the sector boost its cybersecurity.
The FBI publicly confirmed that at least seven states had been targeted as of July 30, but neither the agency nor other government organizations have officially shared any updates.
The attacks, linked to Iranian hackers, have targeted ICS devices made by Rockwell Automation and possibly other major vendors.
CISA has urged the water sector to secure OT in light of the campaign.
Related: SecurityWeek Launches Critical Impact Awards to Recognize Excellence in Industrial Cybersecurity
Related: Novel Private APN Pivot Let Hackers Sabotage Second Polish Energy Facility
Related: Truck Brake Controller’s Safety Recall Doubled as Hidden Security Fix