Cyberattack Affects Over 30 Minnesota Water Systems, FBI Warns of Broader Threat
A coordinated cyberattack struck over 30 community water systems in Minnesota on July 26 and 27, with the FBI later warning that similar incidents had been reported in at least seven states. The attacks disrupted water operations, leading to pressure loss and forcing utilities to revert to manual operations. The FBI noted that the attackers targeted operational technology, which includes the systems controlling wells, pumps, and treatment facilities. In one instance, the controls for a town's well and water treatment plant were shut down, leaving the community reliant on stored water.
While authorities have not confirmed any deliberate contamination of drinking water, the breach of systems responsible for water production and distribution is alarming. Minnesota IT Services reported that the attacks were coordinated, affecting equipment used for remote monitoring and control of water operations. Investigators found similarities in the timing and targeted equipment, although it remains unclear if all systems were compromised by the same group.
The small city of Braham, with a population of about 1,700, experienced a significant impact when its municipal water plant went offline due to the cyberattack. Officials requested residents to limit water use while they investigated the situation. Fortunately, the city managed to restore its systems before running out of stored water. In contrast, Plymouth, a larger city, reported disruptions in communications with its water infrastructure but maintained water levels and quality.
The FBI identified the attacks as focusing on internet-connected programmable logic controllers (PLCs), which are critical for operating equipment in water plants and other infrastructure. Attackers reportedly changed IP addresses and passwords, preventing operators from monitoring and controlling essential equipment. Some utilities also found discrepancies in PLC project files, indicating potential vulnerabilities that could be exploited across multiple systems.
The FBI and EPA issued a public warning on July 30, highlighting the operational effects of the attacks, which included pressure loss and flooding. Loss of pressure can lead to untreated groundwater entering damaged water lines, posing a risk of contamination. Some utilities had to disconnect equipment or issue boil-water notices while repairs were made.
While the FBI has not publicly named the attackers, some cybersecurity officials suspect the activity may be linked to Iranian-affiliated hackers, given the similarities to previous campaigns targeting water infrastructure. However, without formal attribution, this remains speculative.
The United States has approximately 156,000 public water systems, many of which are small and may lack the resources to defend against sophisticated cyber threats. The FBI has recommended that utilities enhance their cybersecurity measures, including removing PLCs from direct internet exposure and implementing secure gateways and firewalls.
The recent attacks underscore the vulnerabilities in America's water infrastructure and the potential for significant disruptions. While the immediate impact in Minnesota was contained, the incident serves as a reminder of the ongoing threats to critical infrastructure and the need for improved security measures to protect public water systems.
