The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned of a sharp increase in cyberattacks targeting technology used to operate water and wastewater systems, urging operators to disconnect internet-exposed systems as quickly as possible to reduce security risks.
The warning follows reports that more than 30 community water systems in Minnesota were targeted in a coordinated cyberattack on July 26 and July 27. The FBI said water and wastewater utilities in at least 7 states have reported similar incidents, with some attacks disrupting water operations.
According to a report, U.S. officials and investigators believe the Minnesota attacks were likely carried out by Iranian-linked hackers. There was no immediate response from representatives of the Iranian government.
The attacks come amid heightened tensions between the U.S. and Iran, with both countries exchanging missile strikes and issuing threats of further escalation.
Authorities said the Minnesota incidents did not affect the safety of drinking water. However, some systems were temporarily taken offline and had to be manually reset. CISA warned that attackers have, in some cases, changed passwords to lock operators out of critical systems and disconnected devices from networks, leading to boil water notices and prolonged manual operations.
The FBI added that some affected utilities reported operational disruptions, including loss of water pressure and flooding.
Most of the confirmed attacks targeted technology used to remotely monitor and control water infrastructure, including programmable logic controllers (PLCs) and the operator interfaces used to manage them.
John Israel, Minnesota’s Chief Information Security Officer, said the state has shared information with the federal government, which is leading efforts to determine whether a specific threat actor is responsible.
Cybersecurity experts said the attacks appear consistent with previous campaigns linked to Iranian-affiliated hackers targeting critical infrastructure. They also noted that a recent update to a federal cybersecurity advisory suggests the campaign has expanded, with attackers using newer techniques and targeting a broader range of devices.
Experts further described the temporary shutdown of water systems during the attacks as a notable escalation compared to earlier incidents.
Also read: Viksit Workforce for a Viksit Bharat
Do Follow: The Mainstream LinkedIn | The Mainstream Facebook | The Mainstream Youtube | The Mainstream Twitter
About us:
The Mainstream is a premier platform delivering the latest updates and informed perspectives across the technology business and cyber landscape. Built on research-driven, thought leadership and original intellectual property, The Mainstream also curates summits & conferences that convene decision makers to explore how technology reshapes industries and leadership. With a growing presence in India and globally across the Middle East, Africa, ASEAN, the USA, the UK and Australia, The Mainstream carries a vision to bring the latest happenings and insights to 8.2 billion people and to place technology at the centre of conversation for leaders navigating the future.