The wave of cyberattacks targeting US water infrastructure has reached New Jersey and Alabama, bringing the confirmed count to at least 12 states since late July. The attacks are linked to Iranian hackers targeting industrial control systems made by Rockwell Automation and potentially other major vendors. Minnesota was the first to confirm over 30 affected water systems, followed by Michigan, South Dakota, and Georgia, and now two more states.
“The City of Cape May Sewer Department and the Borough of Woodbine Water Department reported the attacks on Thursday. Officials said the attacks happened nearly simultaneously early in the morning on July 27.” reports Fox29 “Both systems were impacted for approximately 12 hours.”
Water kept running in both New Jersey districts throughout the incident, and tests afterward confirmed no impact on water quality or safety. Cape May city manager Paul Dietrich told Fox29 that hackers changed settings to prevent remote access to the system, but did not take control of the systems to do anything — which is a meaningful distinction, and not the kind anyone wants to be making about their water supply.
“Cybersecurity experts say hackers could control a lot after breaking into a local water system. ‘They’re actually having the ability to control the water pressure, meaning that they could increase the pressure and cause flooding, or they could decrease the pressure so that you would have a reduced pressure, or ultimately, have no water flow at all,’ said Ian Marlow, CEO of FITECH.” continues Fox29.
In Alabama, the Childersburg Water, Sewer and Gas system was hit the same day, July 27, with hackers targeting industrial control systems. The attack didn’t disrupt water services there either. Neither department’s customer data was accessed in New Jersey, and no significant service disruption was reported in Alabama.
“The Childersburg Water, Sewer, and Gas Board reported that its computerized monitoring and control network was targeted in a cyberattack late last month, prompting officials to temporarily disconnect the system while additional safeguards are put in place.” reports Sylacauga News. “According to the utility, the incident occurred on Monday, July 27 and involved a programmable logic controller, a type of industrial device used to help manage utility operations. Officials said the attack was part of a broader effort that also targeted several other public utilities.”
The pattern across all confirmed states is consistent: attacks targeted operational technology and industrial control systems, some facilities shut down systems as a precaution, disruptions were limited, and drinking water remained safe in every case. The FBI confirmed at least seven states had been targeted as of July 30. Wisconsin, Pennsylvania, and Washington have issued warnings to water utilities without confirming attacks. New York has not said whether its utilities were hit but announced more than $9 million in grants to strengthen water sector cybersecurity.
The practical lesson from every confirmed case so far is the same one CISA has been repeating since its July 30 alert: get PLCs and industrial control systems off direct internet exposure, because the attackers are scanning for exactly that exposure and finding it.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Water Infrastructure)