A US cyber defence agency is warning of a significant increase in hackers targeting water and wastewater systems.
According to the Cybersecurity and Infrastructure Security Agency (CISA), hackers have been targeting automated computers that control systems, known as PLCs, and changing passwords to lock out operators. Boil water notices been issued and systems have had to be operated manually as a result.
The CISA’s warning comes after Minnesota’s state IT agency said more than 30 community water systems in the state faced a “coordinated cyberattack” earlier this week.
US investigators are looking into whether the incident may have been carried out by Iran, according to media reports.
The investigators cautioned that this assessment was preliminary and could change as more data was collected, but comes amid the US-Israel war in Iran and on-and-off negotiations to halt the constant stream of strikes in the region.
The BBC contacted the CISA, which would not confirm the reports about Iran’s possible connection to the Minnesota attacks.
The US has 152,000 public drinking water systems and more than 16,000 wastewater treatment systems. According to the CISA, these systems are vulnerable to threats.
Its warning of potential attacks comes after Minnesota faced attacks on 26 and 27 July, when equipment was remotely monitored and controlled, according to the state’s IT agency.
It said that while investigators confirmed there had been “malicious activity involving a system’s technology,” not all communities there were impacted by a disruption of services, Minnesota IT Services (MNIT) said in a statement.
“We have provided relevant information to the federal government, which is evaluating this activity in the broader national context and leading efforts to determine whether it can be attributed to a specific threat actor,” John Israel, Minnesota’s chief information security officer, said in a statement.
US federal agencies have previously issued advisories warning about the threat of cyber attacks on water and wastewater systems from foreign groups, including groups from Iran.
In April, CISA issued guidance warning that Iranian-affiliated hackers were attacking internet-connected operational devices, including PLCs, made by Rockwell Automation.
Earlier this month, it updated its advisory to include devices manufactured by other companies.
