United States water facilities, which include 150,000 public water systems, have become an increasingly high-risk target for cyber criminals in recent years. This rising threat has demanded more attention and policies focused on improving cybersecurity.
Water and wastewater systems are one of the 16 critical infrastructures in the U.S. The definition for inclusion in this category is that the industry must be so crucial to the United States that “the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety or any combination of those matters.”
According to the X-Force Threat Intelligence Index 2024, energy companies, which include water facilities, ranked fourth in terms of industries attacked, accounting for 11.1% of all attacks. In the energy sector, malware was the most common type of attack (43%), with ransomware coming in second. North America had the second-greatest number of worldwide attacks, with 22%, behind Europe, which experienced 43% of the cases.
Water facilities are at increased risk of cyberattack
The concern became heightened after numerous attacks were made on water facilities. However, drinking water has not been compromised in any attack. One of the Municipal Water Authority of Aliquippa’s booster stations in Pennsylvania was the target of an attack by an Iranian-backed cyber group in October 2023. According to an alert by the Cybersecurity Advisory on December 1, 2023, IRGC cyber actors accessed multiple U.S.-based wastewater system facilities beginning November 22, 2023. Threat actors accessed those facilities, which operate Unitronics Vision Series PLCs, through compromised passwords.
In a recent Wall Street Journal article, Frank Ury, president of the board of the Santa Margarita Water District in southern California, said, “A main concern is that hackers are lying dormant in water facilities’ systems” and that a coordinated attack could target multiple areas at the same time to increase the overall damages and prevent appropriate warnings. Like many water facilities, the Santa Margarita Water District does not have a Chief Information Security Officer. Additionally, Ury shared that only a small portion (15%) of the facilities’ technology budget goes to cybersecurity.
Read the Threat Intelligence Index
Concerns prompt federal government action
With the heightened focus on water facilities, CISA released a specific Incident Response Guide for the wastewater sector in January 2024, indicating potential cybersecurity solutions and variable cyber maturity levels. The IRG provides information about federal roles, resources and responsibilities related to each stage of the cyber incident response. Operators can use this guide to help establish baseline standards and develop stronger incident response plans.
Government officials have also been communicating with states regarding the risk to this industry. According to a March 2024 letter from EPA Administrator Michael Regan and National Security Adviser Jake Sullivan to all state governors, many water facilities do not have even basic cybersecurity precautions, such as resetting default passwords or updating software to address known vulnerabilities.
Because proper cybersecurity can mean the difference between business as usual and a disruptive attack, the letter requested governors to assess their current cybersecurity practices to identify any significant vulnerabilities, deploy practices and controls to reduce cybersecurity risks where needed and exercise plans to prepare for, respond to and recover from a cyber incident.
In April 2024, Representatives Rick Crawford (R., Ark.) and John Duarte (R., Cal.) proposed a bill creating the Water Risk and Resilience Organization (WRRO), a governing body to develop cybersecurity mandates for water systems. The goal of the WRRO is to work with the EPA to develop and enforce cybersecurity requirements for drinking and wastewater systems.
“Foreign adversaries, such as Russia and China, have utilized cyberattacks to target critical infrastructure such as water systems. This bill is a more proactive approach to safeguarding our drinking and wastewater from these types of attacks. These protections are vital at a time where cyber threats are constant and technology is evolving quickly,” Rep. Crawford said in the announcement.