A wave of cyberattacks targeting U.S. public water systems is heightening concerns about security gaps at utilities, with government officials warning that hackers are exploiting a particularly vulnerable industrial computer, according to security experts.
U.S. water systems in at least a dozen states have been targeted by the attacks, which officials suspect may be linked to Iran-backed hackers. Officials say the attacks have not affected drinking water, and utilities have quickly regained control of their systems.
But cybersecurity experts said the incidents expose longstanding weaknesses in thousands of public water systems, many of which rely on poorly secured, internet-connected industrial computers.
These components, called programmable logic controllers, or PLCs, turn industrial equipment on and off, controlling factors such as water pressure or chemicals added in treatment plants.
PLCs are often connected to the internet, allowing hackers to gain access to their functions, the Cybersecurity & Infrastructure Security Agency (CISA) said in a July 30 notice. Sometimes PLCs have no passwords or easily guessed ones, security experts told CBS News.
“The bottom line is there’s no one guarding these systems,” Joshua Corman, executive in residence for public safety and resilience at the Institute for Security and Technology, a security think tank, told CBS News. “These systems were directly on the internet with no firewalls or VPNs or anything, with no passwords set in most cases.”
Water systems are being targeted specifically because they offer “low-hanging fruit” for malicious actors, said Michael Garcia, policy director of the Operational Technology Cybersecurity Coalition.
Here’s what to know about the water system cyberattacks.
There are reports of cyberattacks on water systems in a dozen states, but because there’s no federal regulation requiring local utilities to report hacks, more may have gone unreported, Garcia said.
“There’s nothing that requires [utilities] to say, ‘Here’s all the information that we have. Here’s how it happened,'” Garcia said. “This [disclosure] has really been on a goodwill basis, so we actually don’t even know the large-scale impact, if there is one.”
Among the states with reported breaches are:
CISA said the hackers are targeting exposed PLCs, locking out operators and disconnecting the devices by changing their IP addresses. In a July 30 statement, the FBI said targeted water utilities have experienced pressure loss and flooding.
In Georgia’s Clayton County, the disruption caused a drop in water pressure and forced the agency to issue a boil-water advisory. Service was restored within hours, however.
Some utilities have lost critical remote-control capabilities, forcing operators to switch to manual mode. In several cases, the hackers gained remote access to pumps, valves and water pressure.
So far, the targeted utilities have swiftly regained control of their systems, often by taking them offline and switching to manual control, security experts noted. But the worry is that hackers could cause greater disruptions, such as a surge in water pressure that could burst pipes and endanger critical facilities, including hospitals, Corman said.
“No water means no hospital in two to four hours,” he said. “A loss of water pressure might look like an inconvenience for the water sector, but it could actually be a mass casualty event for the hospital that depends upon it.”
Because no one has publicly claimed responsibility for the attacks, the attackers’ objectives remain unclear, security experts said.
But with Iran-backed hackers suspected in the incidents, their efforts may be aimed at psychological revenge for the U.S.’s war with Iran, sending a message to the Trump administration or threatening to stir panic among civilians, Corman said.
“It can also be used as a signal to the Trump administration to say, ‘Don’t mess with us because we’re in your systems,'” he said. “So it could be a deterrent.”
The risks are serious, but consumers shouldn’t panic, the security experts told CBS News.
“We’re lucky that it wasn’t worse, but part of that luck is because we have good public utility workers,” Garcia said.
Both Garcia and Corman recommended that people store some water at home in case of an emergency, whether that’s a natural disaster like a hurricane or a man-made issue like a utility hack.
“What I always tell folks is focus on what you can control, and what you can control is being prepared,” Garcia said. “FEMA has always said that you should have one gallon of water a day for however many people are in your household for at least two or three days.”
Consumers can also keep a water filtration device on hand, such as a LifeStraw, in case of a water disruption, Corman noted.
“There’s a huge difference between being a prepper and being rationally prepared for occasional disruption,” he said.
