Particle.news
Get it on Google Play
Download on the App Store
4 ARTICLES
·
2mo ago

Cyber Lockouts Hit Dozens of U.S. Municipal Water Systems

An FBI-led probe signals the need for binding standards, emergency funding, federal cyber capacity to protect small water utilities.

A cyberattack in late July targeted the operating technology at over 30 water systems in Minnesota, including the town of Plymouth, state officials said. A water tower is shown in Plymouth, July 30, 2026.
It was therefore noteworthy, but should have come as no surprise, when America’s own water facilities came under attack this summer.
The East Bay Municipal Utility District Wastewater Treatment Plant on March 20, 2024 in Oakland, California. The Biden Administration and the Environmental Protection Agency had warned states of possible cyberattacks on water systems.
Image

Overview

  • In late July attackers remotely accessed internet-connected controllers at dozens of water and wastewater sites, changing IP addresses and passwords and locking operators out of systems.
  • The FBI confirmed reports from utilities in multiple states and is leading a multistate investigation with support from CISA and the EPA.
  • Federal and state guidance has urged operators to disconnect or isolate exposed programmable logic controllers while crews switch to manual controls and restore service quickly.
  • Officials and media reports point to Iranian-affiliated groups as a leading hypothesis but forensic attribution remains unverified and could be deceptive.
  • The incidents exposed systemic weaknesses—legacy, internet-exposed PLCs, weak or default credentials, and underfunded small utilities—and have prompted calls for federal grants, minimum cybersecurity rules, and shared services as CISA faces staffing and budget pressures.