Are hacks of U.S. water facilities a new front in the Iran war?

A water tower is seen on July 30 in Plymouth, Minn. A cyberattack targeted the operating technology at over 30 water systems in Minnesota, including Plymouth's late last month, state officials said. Ellen Schmidt/AP hide caption

On a recent Monday morning in Braham, Minn., a local water operator made an unsettling discovery — the pump at the treatment plant wasn't working, threatening the flow of water to people's homes.

While investigating the root cause, crews took the plant offline, and the city urged Braham's 1,700 or so residents to conserve water while they drew on a backup supply stored in a local tank.

It only took a couple of hours for workers to restore the flow after taking manual control of the pump. The self-proclaimed homemade pie capital of Minnesota still hosted its annual Pie Day celebration at the Park Cafe just days later.

National Security Flushable wipes and Iran: Water treatment facility adds cyberattacks to worry list But what Braham officials quickly learned, after connecting with Minnesota state IT teams, was that they were not alone in the outages. The cause was a "coordinated cyberattack" against industrial technology nationwide, and cybersecurity experts and federal officials suspected Iran may be to blame.

It's nothing new. Adversaries, including Iran, have been targeting U.S. critical infrastructure for years, to steal data or cause disruptions. Once inside, they can ransom the data to make money or threaten access to and trust in critical resources, from water and power to transportation and their bank accounts. "Everything's connected to the internet in one way or another," Nate George, the mayor of Braham, told NPR in an interview. "It's not Braham in particular that's being targeted. It's the internet access points and the vulnerable technology," George, a U.S. Air Force reservist, continued.

While the hackers failed to compromise the water supply, they succeeded in inspiring headlines and provoking uncertainty. And the scope, scale and real-world impacts of the attacks, like the one in Braham, have been remarkable even to the experts.

"I can't recall a time when there's been this many targets at once with operational impact," said Rob Lee, the co-founder and CEO of Dragos, a cybersecurity firm focused on industrial technology. Lee told NPR he's aware of victims of this recent spate of attacks outside the water sector, as critical infrastructure operators tend to rely on the same technology. It's something Lee has been warning about for years. "This is pretty significant," Lee said.

Local and federal officials are looking to get their arms around what happened, help critical infrastructure operators secure their systems, reassure the public and prepare for the future for the more than 150,000 water and wastewater treatment systems in the U.S. — because the next wave of attacks could be worse.

"It appears this is a shot across the bow from Iran," Jake Braun, the former White House acting principal deputy national cyber director during the Biden administration, told NPR.

Between July 26 and July 28, several local authorities in Minnesota let citizens know about problems at community water plants from Braham to Maple Plain, Minn., where officials declared a brief state of emergency before determining that "the immediate threat to public health, safety and welfare had been addressed."

Cities and towns across the country began to join their ranks. In Clayton County outside Atlanta, local officials issued a brief "boil water" advisory after a pump station failure was detected in the middle of the night. There were other outages in New Jersey and Michigan.

A cybersecurity information-sharing organization for the water sector, WaterISAC, was quick to convene a call for its 400 or so members across community water systems to disseminate intelligence from the federal government about the attacks. The EPA followed up with a publicly available webinar "to discuss an urgent operational matter dealing with cyber threats to the water sector."

The FBI then confirmed that at least seven states suffered similar attacks on water and wastewater facilities. Their investigation is ongoing.

The scope and scale could be much larger. Beyond Lee of Dragos mentioning victims outside the water sector, one state IT official who requested anonymity because they weren't authorized to comment on ongoing investigations, said there's still concern about the transportation and energy sectors being impacted by these attacks.

"I think that we have to assume that this attack is national in scope," said Braun, now the executive director of the Cyber Policy Initiative at the University of Chicago.

The U.S. government hasn't officially said yet who they think is responsible for the latest attacks on the water sector.

But it wouldn't be the first time nation-states have disrupted critical services for geopolitical reasons. Starting in 2015, Russia notably launched a series of cyberattacks on Ukrainian power grids, plunging residents into darkness before ever launching a full-scale invasion.

Iranian-linked hackers have gone after U.S. power and water before.

For example, in 2023, an Iranian-linked hacktivist group broke into and defaced industrial machines in a water facility in Aliquippa, Pa. The machines, some of whose components were made in Israel, were manipulated to display anti-Israel messages during the war between Israel and Hamas.

The Department of Homeland Security's Cybersecurity and Infrastructure Security Agency has published a detailed advisory about Iranian-linked hackers looking for vulnerabilities in industrial machines like those found in the water sector. That advisory first came out in April, and the authors updated it just days before this recent spate of attacks.

Sources & Methods Did Iran hack U.S. water systems? / Cyberwarfare abroad / Ukraine's air defense gap Michael Crean of cybersecurity firm SonicWall tells NPR that his company has seen a rece...

Indexed and credited by AIPROPX. Originating outlet: NPR News. Open at source →