US cyber defence agency warns hackers are increasingly targeting water systems

The US government’s civilian cyber defence agency on July 30 warned of a significant increase in hackers targeting technology used to maintain and control water and wastewater systems, and said operators of such systems should remove them from the internet as soon as possible.

The warning comes two days after Minnesota’s state IT agency said more than 30 community water systems in the state were targeted in a “coordinated cyberattack” on July 26 and 27.

The FBI said in a statement late on July 30 that water and wastewater utility companies in at least seven states have reported incidents to the bureau, and that some of that activity “degraded water operations”.

US officials and investigators reviewing the matter say it is likely Iranian-linked hackers are behind the Minnesota attacks, the New York Times reported on July 30. Representatives for the Iranian government did not immediately respond to a request for comment.

The attacks come amid an intensification of the war between the US and Iran, with the two sides trading missile attacks, and ongoing threats from both sides for increased destruction.

Iranian-linked hacking activity targeting US water facilities predates the war, but a range of groups have carried out a series of prominent cyberattacks on domestic US organisations, including medical services company Stryker and the Los Angeles County Metropolitan Transportation Authority in March.

The White House referred questions about the Minnesota incidents to the FBI. The FBI did not immediately respond to a request for comment about alleged Iranian involvement in the incidents.

State and local officials have said the Minnesota attacks did not threaten water safety, but that in some cases certain systems were taken offline and had to be reset manually.

The July 30 alert from the Cybersecurity and Infrastructure Security Agency warned that hackers have, in some cases, changed passwords to lock out operators and disconnect certain devices from the networks, resulting in “boil water notices and sustained manual operations”.

Unidentified victims have reported to the FBI that “operational effects” of the attacks have, in certain places, included loss of pressure and flooding, according to the FBI’s statement.

Minnesota IT Services, the information technology agency for the state’s executive branch, said in a statement that the investigation into the incidents is ongoing.

Most of the confirmed cases involved technology that water systems use to remotely monitor and control equipment, including programmable logic controllers (PLCs), and the computer screens operators use to manage them.

John Israel, Minnesota’s chief information security officer, said in the statement that the state has “provided relevant information to the federal government, which is evaluating this activity in the broader national context and leading efforts to determine whether it can be attributed to a specific threat actor.”

Iran suspected

Cynthia Kaiser, a former senior FBI cybersecurity official, told Reuters that it was highly likely that the Minnesota hacking campaigns were a continuation of prior Iranian-affiliated targeting of PLCs and other critical infrastructure technology noted by CISA, the FBI, NSA and other federal agencies in an April advisory.

That advisory was updated on July 22 to include a wider scope of targeted devices than originally tracked as well as more current techniques and activities carried out by the hackers.

“The fact that a new advisory came out is really indicative of either a broadening of the campaign, new technical details or a renewal of the activity, and probably a combination of all those things,” said Kaiser, now an executive with cybersecurity firm Halcyon.

Chris Day, public sector chief technical officer with cybersecurity firm Tenable, said the Minnesota incidents are “consistent” with the prior Iranian-linked activity, and that the publicly reported information of some systems being taken temporarily offline represents an “interesting escalation” to prior events. REUTERS