Cyberattack Targets Over 30 Water Systems in Minnesota

A cyberattack recently targeted the operating technology of more than 30 water systems in Minnesota, including the system in Plymouth. State officials revealed this issue to the public.

Incident in Braham

In Braham, Minnesota, a local water operator discovered that a pump at the treatment plant was malfunctioning, disrupting water flow to homes. Crews had to take the plant offline, and the city urged its 1,700 residents to conserve water. Fortunately, workers managed to restore service within hours by manually controlling the pump. Meanwhile, the community still hosted its annual Pie Day celebration.

It soon became apparent that Braham was not the only target. The issue stemmed from a “coordinated cyberattack” against industrial technology nationwide. Cybersecurity experts and federal officials suspect Iran could be responsible.

Wider Implications

Adversaries like Iran have been targeting US critical infrastructure for years, aiming to steal data or cause disruptions. Once inside, they can threaten resources such as water and power.

“Everything’s connected to the internet in one way or another,” Nate George, the mayor of Braham, said. “It’s not Braham in particular that’s being targeted. It’s the internet access points and vulnerable technology.”

Although the hackers failed to compromise the water supply, they attracted attention and concern. The scale and impact of these attacks surprised experts.

Experts stress the need to secure more than 150,000 water and wastewater systems in the US against future attacks, which might be more severe.

Attack Timeline

Between July 26 and July 28, several Minnesota communities reported problems with their water plants. Local authorities issued advisories, and some areas declared states of emergency until it was clear the threat was contained.

Cities outside Minnesota, including places in Georgia, New Jersey, and Michigan, also experienced issues. Responding to the situation, WaterISAC, a cybersecurity organization, held calls to share intelligence. The EPA hosted a webinar on cyber threats, and the FBI has confirmed attacks in at least seven states.

Ties to Iran

The US government has not officially named a culprit, but historical precedents highlight nation-states, such as Iran, disrupting critical services for geopolitical reasons. Iran has targeted US power and water systems before.

A recent advisory from the Department of Homeland Security noted that Iranian-linked hackers search for vulnerabilities in industrial machines like those in the water sector.

While no group has claimed responsibility for the water attacks, there is intelligence linking the activity to the Iranian Revolutionary Guard Corps. Iran is reportedly targeting to demonstrate their capabilities of shutting critical services.

Local Expert Insights

Some water industry members have long been aware of these issues. For instance, Chris Hughes from Cavendish, Vermont, has been involved in cybersecurity pilot programs.

Industrial operators face risks from both natural disasters and malicious actors. Hughes noted that it is challenging to “poison” water remotely, though hackers could cause significant damage through other means, such as manipulating water pressure.

Many operators hesitate to embrace technology for fear of exposing systems to cyber threats, despite benefits like remote monitoring.

Future Actions

Practical measures can protect water systems from basic attacks, such as changing default passwords, taking machines offline, and implementing strong access controls.

Still, more sophisticated future attacks may be harder to manage. Awareness of stealthy actors like China’s Volt Typhoon underscores the need for vigilance.

Braham’s Mayor George emphasizes strategic planning to counter such threats, recognizing the potential for significant disruptions.

Securing critical infrastructure demands cooperation among federal, private, and local partners. The water sector requires additional resources to enhance security standards.

Addressing Resource Needs

The American Water Works Association (AWWA) has advocated for increased federal funding following recent cyberattacks. Organizations like WaterISAC aim to facilitate information sharing and support for water operators.

Project Franklin is one initiative focused on preparing facilities with expert volunteers. Collaborations with research institutions aim to train AI tools capable of defending systems in real time.

Federal Leadership Challenges

Nationwide efforts exist to strengthen water operators’ capabilities, but systemic issues remain. Many local systems lack visibility and struggle with resource limitations.

The US federal cybersecurity workforce has shrunk in recent years due to broader bureaucratic reductions, compounding difficulties in addressing threats.

Project Franklin and similar initiatives may require sustained federal funding to achieve lasting success. Experts call for comprehensive government leadership to tackle infrastructure security challenges proactively.