Iran Under Suspicion: A Wave of Cyberattacks on U.S. Water Utilities

Over the past two weeks, the United States has been swept by a wave of cyberattacks on water utilities. Facilities in roughly a dozen states have been hit, and it is the scale—not the intrusions themselves—that alarms specialists most.

Timeline

On July 28, Minnesota authorities reported that water treatment plants in more than 30 communities had come under a coordinated attack. Two days later, the FBI announced incidents at water and wastewater utilities “in at least seven states,” with some attacks “disrupting operations” in individual cases. Reports later came in from Arkansas, Georgia, New Jersey and Michigan.

The U.S. has more than 150,000 water systems, many of them run by small local companies. On the one hand, that fragmentation should make it harder to strike many targets at once. On the other, such operators often have neither the funds nor the staff to defend themselves.

Who Is to Blame

The short answer: officially, no one knows—but the prime suspect is the Iranian government. The first incidents in Minnesota came shortly after the agency CISA warned that Iranian hackers were targeting internet-connected devices in the water and energy sectors.

President Donald Trump said he did not consider the events an “Iranian cyberattack,” and placed the blame on the state itself, which is led by Democratic Governor Tim Walz. Meanwhile, according to The Washington Post, U.S. intelligence is “confident” of Iran’s involvement, and in particular that of the Islamic Revolutionary Guard Corps. There has been no public accusation: the intelligence services have yet to identify a specific unit and may not want to contradict Trump’s statement.

Iranian hackers have a history of attacks on U.S. critical infrastructure, and the current campaign may be revenge for the six-month war. Their earlier successes were limited: in March, the group Handala—which the U.S. links to Iranian intelligence—disrupted the medtech giant Stryker and broke into the personal email of FBI Director Kash Patel.

The Fallout

Many industrial controllers are directly accessible from the internet: the company Forescout recently counted more than 2,800 such devices in U.S. water systems. That alone does not mean control can be seized, but in some cases that is exactly what happened. The FBI reported a loss of pressure that meant “untreated groundwater could seep into the pipes,” as well as flooding.

The town of Bram in Minnesota shut down its plant for several hours and asked roughly 1,700 residents to conserve water; Maple Plain briefly declared a state of emergency; in a county outside Atlanta, people were temporarily advised to boil their water.

But the main effect may be psychological. The wide coverage of the attacks made people question the safety of something as basic as drinking water—and sowing panic and fear could well be part of the attackers’ design.

Source: TechCrunch