The U.S. government’s civilian cyber defense agency this week warned of a significant increase in hackers targeting technology used to maintain and control water and wastewater systems, and said operators of such systems should remove them from the internet as soon as possible.
The warning Thursday came two days after Minnesota’s state IT agency said more than 30 community water systems in the state were targeted in a "coordinated cyberattack.”
The FBI said in a statement late Thursday that water and wastewater utility companies in at least seven states reported incidents to the bureau, and some of that activity "degraded water operations."
The Coolidge Dam is seen July 3 at San Carlos Reservoir near Peridot, Ariz. The U.S. government’s civilian cyber defense agency warned of a significant increase in hackers targeting technology used to maintain and control water and wastewater systems.
U.S. officials and investigators reviewing the matter say it is likely Iranian-linked hackers are behind the Minnesota attacks, the New York Times reported.
Representatives for the Iranian government did not immediately respond to a request for comment.
People are also reading…
The attacks come as the war between the U.S. and Iran intensifies, with the two sides trading missile attacks, and ongoing threats from both sides for increased destruction.
Iranian-linked hacking activity targeting U.S. water facilities predates the war, but a range of groups carried out a prominent cyberattacks on domestic U.S. organizations, including medical services company Stryker and the Los Angeles County Metropolitan Transportation Authority in March.
The White House referred questions about the Minnesota incidents to the FBI.
State and local officials said the Minnesota attacks did not threaten water safety but, in some cases, certain systems were taken offline and had to be reset manually.
Thursday's alert from the Cybersecurity and Infrastructure Security Agency warned that hackers have, in some cases, changed passwords to lock out operators and disconnect certain devices from the networks, resulting in "boil water notices and sustained manual operations."
Unidentified victims reported to the FBI that "operational effects" of the attacks have, in certain places, included flooding and loss of water pressure, according to the FBI's statement.
Minnesota IT Services, the information technology agency for the state's executive branch, said in a statement that the investigation into the incidents was ongoing. Most of the confirmed cases involved technology that water systems use to remotely monitor and control equipment, including programmable logic controllers, or PLCs, and the computer screens operators use to manage them.
John Israel, Minnesota's chief information security officer, said in the statement that the state "provided relevant information to the federal government, which is evaluating this activity in the broader national context and leading efforts to determine whether it can be attributed to a specific threat actor."
US strikes southern Iran kill civilians and IRGC members; Tehran hits Kuwait, Jordan and rejects Oman plan to reopen Hormuz.
Iran suspected
Cynthia Kaiser, a former senior FBI cybersecurity official, told Reuters it was highly likely the Minnesota hacking campaigns were a continuation of prior Iranian-affiliated targeting of PLCs and other critical infrastructure technology noted by CISA, the FBI, NSA and other federal agencies in an April advisory.
That advisory was updated July 22 to include a wider scope of targeted devices than originally tracked as well as more current techniques and activities carried out by the hackers.
"The fact that a new advisory came out is really indicative of either a broadening of the campaign, new technical details or a renewal of the activity, and probably a combination of all those things," said Kaiser, now an executive with cybersecurity firm Halcyon.
Chris Day, public sector chief technical officer with cybersecurity firm Tenable, said the Minnesota incidents are "consistent" with the prior Iranian-linked activity, and that the publicly reported information of some systems being taken temporarily offline represents an "interesting escalation" to prior events.
