United States water facilities, which include 150,000 public water systems, have become an increasingly high-risk target for cyber criminals in recent years. This rising threat has demanded more attention and policies focused on improving cybersecurity.

Water and wastewater systems are one of the 16 critical infrastructures in the U.S. The definition for inclusion in this category is that the industry must be so crucial to the United States that “the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety or any combination of those matters.”

According to the X-Force Threat Intelligence Index 2024, energy companies, which include water facilities, ranked fourth in terms of industries attacked, accounting for 11.1% of all attacks. In the energy sector, malware was the most common type of attack (43%), with ransomware coming in second. North America had the second-greatest number of worldwide attacks, with 22%, behind Europe, which experienced 43% of the cases.

Water facilities are at increased risk of cyberattack

The concern became heightened after numerous attacks were made on water facilities. However, drinking water has not been compromised in any attack. One of the Municipal Water Authority of Aliquippa’s booster stations in Pennsylvania was the target of an attack by an Iranian-backed cyber group in October 2023. According to an alert by the Cybersecurity Advisory on December 1, 2023, IRGC cyber actors accessed multiple U.S.-based wastewater system facilities beginning November 22, 2023. Threat actors accessed those facilities, which operate Unitronics Vision Series PLCs, through compromised passwords.

In a recent Wall Street Journal article, Frank Ury, president of the board of the Santa Margarita Water District in southern California, said, “A main concern is that hackers are lying dormant in water facilities’ systems” and that a coordinated attack could target multiple areas at the same time to increase the overall damages and prevent appropriate warnings. Like many water facilities, the Santa Margarita Water District does not have a Chief Information Security Officer. Additionally, Ury shared that only a small portion (15%) of the facilities’ technology budget goes to cybersecurity.

Read the Threat Intelligence Index

Concerns prompt federal government action

With the heightened focus on water facilities, CISA released a specific Incident Response Guide for the wastewater sector in January 2024, indicating potential cybersecurity solutions and variable cyber maturity levels. The IRG provides information about federal roles, resources and responsibilities related to each stage of the cyber incident response. Operators can use this guide to help establish baseline standards and develop stronger incident response plans.

Government officials have also been communicating with states regarding the risk to this industry. According to a March 2024 letter from EPA Administrator Michael Regan and National Security Adviser Jake Sullivan to all state governors, many water facilities do not have even basic cybersecurity precautions, such as resetting default passwords or updating software to address known vulnerabilities.

Because proper cybersecurity can mean the difference between business as usual and a disruptive attack, the letter requested governors to assess their current cybersecurity practices to identify any significant vulnerabilities, deploy practices and controls to reduce cybersecurity risks where needed and exercise plans to prepare for, respond to and recover from a cyber incident.

In April 2024, Representatives Rick Crawford (R., Ark.) and John Duarte (R., Cal.) proposed a bill creating the Water Risk and Resilience Organization (WRRO), a governing body to develop cybersecurity mandates for water systems. The goal of the WRRO is to work with the EPA to develop and enforce cybersecurity requirements for drinking and wastewater systems.

“Foreign adversaries, such as Russia and China, have utilized cyberattacks to target critical infrastructure such as water systems. This bill is a more proactive approach to safeguarding our drinking and wastewater from these types of attacks. These protections are vital at a time where cyber threats are constant and technology is evolving quickly,” Rep. Crawford said in the announcement.

More from Risk Management

2024 roundup: Top data breach stories and industry trends

3 min read - With 2025 on the horizon, it’s important to reflect on the developments and various setbacks that happened in cybersecurity this past year. While there have been many improvements in security technologies and growing awareness of emerging cybersecurity threats, 2024 was also a hard reminder that the ongoing fight against cyber criminals is far from over.We've summarized this past year's top five data breach stories and industry trends, with key takeaways from each that organizations should note going into the following…

Black Friday chaos: The return of Gozi malware

4 min read - On November 29th, 2024, Black Friday, shoppers flooded online stores to grab the best deals of the year. But while consumers were busy filling their carts, cyber criminals were also seizing the opportunity to exploit the shopping frenzy. Our system detected a significant surge in Gozi malware activity, targeting financial institutions across North America. The Black Friday connection Black Friday creates an ideal environment for cyber criminals to thrive. The combination of skyrocketing transaction volumes, a surge in online activity…

How TikTok is reframing cybersecurity efforts

4 min read - You might think of TikTok as the place to go to find out new recipes and laugh at silly videos. And as a cybersecurity professional, TikTok’s potential data security issues are also likely to come to mind. However, in recent years, TikTok has worked to promote cybersecurity through its channels and programs. To highlight its efforts, TikTok celebrated Cybersecurity Month by promoting its cybersecurity focus and sharing cybersecurity TikTok creators.Global Bug Bounty program with HackerOneDuring Cybersecurity Month, the social media…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today