United States water facilities, which include 150,000 public water systems, have become an increasingly high-risk target for cyber criminals in recent years. This rising threat has demanded more attention and policies focused on improving cybersecurity.

Water and wastewater systems are one of the 16 critical infrastructures in the U.S. The definition for inclusion in this category is that the industry must be so crucial to the United States that “the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety or any combination of those matters.”

According to the X-Force Threat Intelligence Index 2024, energy companies, which include water facilities, ranked fourth in terms of industries attacked, accounting for 11.1% of all attacks. In the energy sector, malware was the most common type of attack (43%), with ransomware coming in second. North America had the second-greatest number of worldwide attacks, with 22%, behind Europe, which experienced 43% of the cases.

Water facilities are at increased risk of cyberattack

The concern became heightened after numerous attacks were made on water facilities. However, drinking water has not been compromised in any attack. One of the Municipal Water Authority of Aliquippa’s booster stations in Pennsylvania was the target of an attack by an Iranian-backed cyber group in October 2023. According to an alert by the Cybersecurity Advisory on December 1, 2023, IRGC cyber actors accessed multiple U.S.-based wastewater system facilities beginning November 22, 2023. Threat actors accessed those facilities, which operate Unitronics Vision Series PLCs, through compromised passwords.

In a recent Wall Street Journal article, Frank Ury, president of the board of the Santa Margarita Water District in southern California, said, “A main concern is that hackers are lying dormant in water facilities’ systems” and that a coordinated attack could target multiple areas at the same time to increase the overall damages and prevent appropriate warnings. Like many water facilities, the Santa Margarita Water District does not have a Chief Information Security Officer. Additionally, Ury shared that only a small portion (15%) of the facilities’ technology budget goes to cybersecurity.

Read the Threat Intelligence Index

Concerns prompt federal government action

With the heightened focus on water facilities, CISA released a specific Incident Response Guide for the wastewater sector in January 2024, indicating potential cybersecurity solutions and variable cyber maturity levels. The IRG provides information about federal roles, resources and responsibilities related to each stage of the cyber incident response. Operators can use this guide to help establish baseline standards and develop stronger incident response plans.

Government officials have also been communicating with states regarding the risk to this industry. According to a March 2024 letter from EPA Administrator Michael Regan and National Security Adviser Jake Sullivan to all state governors, many water facilities do not have even basic cybersecurity precautions, such as resetting default passwords or updating software to address known vulnerabilities.

Because proper cybersecurity can mean the difference between business as usual and a disruptive attack, the letter requested governors to assess their current cybersecurity practices to identify any significant vulnerabilities, deploy practices and controls to reduce cybersecurity risks where needed and exercise plans to prepare for, respond to and recover from a cyber incident.

In April 2024, Representatives Rick Crawford (R., Ark.) and John Duarte (R., Cal.) proposed a bill creating the Water Risk and Resilience Organization (WRRO), a governing body to develop cybersecurity mandates for water systems. The goal of the WRRO is to work with the EPA to develop and enforce cybersecurity requirements for drinking and wastewater systems.

“Foreign adversaries, such as Russia and China, have utilized cyberattacks to target critical infrastructure such as water systems. This bill is a more proactive approach to safeguarding our drinking and wastewater from these types of attacks. These protections are vital at a time where cyber threats are constant and technology is evolving quickly,” Rep. Crawford said in the announcement.

More from Risk Management

Digital solidarity vs. digital sovereignty: Which side are you on?

4 min read - The landscape of international cyber policy continues to evolve rapidly, reflecting the dynamic nature of technology and global geopolitics. Central to this evolution are two competing concepts: digital solidarity and digital sovereignty.The U.S. Department of State, through its newly released International Cyberspace and Digital Policy Strategy, has articulated a clear preference for digital solidarity, positioning it as a counterpoint to the protectionist approach of digital sovereignty.What are the main differences between these two concepts, and why does it matter? Let’s…

A decade of global cyberattacks, and where they left us

5 min read - The cyberattack landscape has seen monumental shifts and enormous growth in the past decade or so.I spoke to Michelle Alvarez, X-Force Strategic Threat Analysis Manager at IBM, who told me that the most visible change in cybersecurity can be summed up in one word: scale. A decade ago, “'mega-breaches' were relatively rare, but now feel like an everyday occurrence.”A summary of the past decade in global cyberattacksThe cybersecurity landscape has been impacted by major world events, especially in recent years.…

It all adds up: Pretexting in executive compromise

4 min read - Executives hold the keys to the corporate kingdom. If attackers can gain the trust of executives using layered social engineering techniques, they may be able to access sensitive corporate information such as intellectual property, financial data or administrative control logins and passwords.While phishing remains the primary pathway to executive compromise, increasing C-suite awareness of this risk requires a more in-depth approach from attackers: Pretexting.What is pretexting?Pretexting is the use of a fabricated story or narrative — a “pretext” — to…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today