RESOLVING THE LEDGER
This is one outlet's own report from CBS News — Top — the article as it was filed. Other outlets are covering the same event; open the full story to compare every source side by side.
See the full story · 4 sources
Malicious cyber activity affected technology at more than 30 community water systems across Minnesota this week, forcing some utilities to switch to manual operations as state and federal authorities dig into who is behind the attack, CBS News has learned.\u00a0Investigators are probing to determine whether the activity is the work of Iranian hackers, according to U.S. officials and sources familiar with the incident. Sources cautioned that since they had not definitively attributed the attack, their assessment could change as additional technical evidence is collected. They are also probing whether the actor could have attempted to appear Iran-based as a way of stirring the pot amid the ongoing U.S. conflict with Iran.\u00a0Minnesota and the federal government have not publicly attributed the activity to a particular actor.Most confirmed cases in the apparent cyberattack involved technology used to remotely monitor and control water system equipment, including devices called programmable logic controllers, according to Minnesota IT Services.None of Minnesota\u0027s water supply has been reported compromised as a result of the attack, Mike Ernster, a public information officer for the Minnesota Department of Public Safety, told CBS News. The Bureau of Criminal Apprehension\u0027s Minnesota Fusion Center was working with municipalities, as well as state and federal partners, to address the issue, he added.Nick Anderson, acting director of the federal Cybersecurity and Infrastructure Security Administration, confirmed that the agency "is currently observing a significant increase in cyber threat actors targeting programmable logic controllers (PLC) at water utilities."\u00a0"We urge critical infrastructure owners and operators to remove publicly exposed PLCs and other operational technology from the internet as soon as possible," he added.Minnesota said investigators identified some similarities in the timing of the recent incidents, in addition to the types of technology impacted, but had not yet confirmed that every incident was carried out by the same actor.A spokesperson for the city of South St. Paul told CBS News it identified an issue early Monday and immediately implemented contingency procedures. Public works employees transitioned to manual operations, allowing water and wastewater services to continue without any interruption to service. The city added that the incident was limited to technology supporting portions of its water utility, while drinking water treatment, quality, pressure and delivery were not impacted.\u00a0Officials in South St. Paul found no indication that resident or customer data was accessed.In Braham, located in a more rural area north of Minneapolis, public works personnel also discovered the problem Monday after noticing the well supplying the city\u0027s water tower was malfunctioning. Workers isolated the affected system, restored a backup and restarted the plant in about 90 minutes, Mayor Nate George confirmed to CBS News.\u00a0Residents experienced no loss of water service, George added. The city\u0027s water tower typically holds enough drinking water to last about two days, and operators discovered the problem before receiving an automated alert, leading the city to believe the pump had been offline for only a brief period. The city has since ensured the system is not connected to any public-facing internet networks and is meeting with its technology provider about remediation.The FBI said it was aware of the incident and in contact with victims but declined to provide additional information.The Cybersecurity and Infrastructure Security Agency (CISA) said Thursday that it\u0027s "currently observing a significant increase in cyber threat actors" that are targeting PLCs in the Water and Wastewater Systems sector, noting those actors are targeting "water entities of all sizes.""CISA urges critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible," said CISA, which is part of the Department of Homeland Security.\u00a0"Even water organizations with mature cybersecurity processes should validate their external connections, as this targeting activity includes cellular modems installed by operators, vendors, or system integrators that may not be documented or included in routine attack surface scans," CISA added in its advisory.Iran-linked hackers have previously targeted U.S. water utilities. Federal agencies confirmed previously that actors affiliated with Iran\u0027s Islamic Revolutionary Guard Corps used a similar playbook, accessing multiple water and wastewater facilities in 2023 by exploiting internet-connected controllers that retained their default passwords.
AIPROPX is an independent multi-source news index — we track, compare, and connect coverage from across the web into one place you won't find anywhere else.