Iran-linked threat actors hack America’s water infrastructure as experts warn of growing risks

Federal and state authorities are investigating a series of cyber-attacks affecting critical infrastructure across the U.S. in incidents cybersecurity experts tell Heartlander News could become more common.

Threat actors, some with suspected ties to Iran, have affected water infrastructure across America since July 26, impacting at least 12 states including Minnesota, Michigan, Georgia, South Dakota, New Jersey and Kansas. Cybersecurity experts told Heartlander News that many security failures across the U.S. were swiftly addressed and that the affected systems pivoted to manual operations while they severed compromised systems from the internet.

Some of these breaches triggered advisories for residents to boil their water before use. Places such as Pennington County in South Dakota have been reeling from the breaches and were still working to restore operations as of Sunday, local news reported.

Ginger Wright, an engineering program manager at the Idaho National Lab, told Heartlander News that cyber security risks to America’s water infrastructure and other utilities could increase as systems modernize.

“As we move into the future, there will be more digitization in the water processing and water distribution, and that may expand the attack surface for the adversary,” Wright said. “Modernization comes at a cost.”

Digitizing water infrastructure increases opportunities for internet access, and unsecured access gives hackers or foreign adversaries more gaps to exploit. Though it’s effectively impossible for a hacker to introduce a toxin to water systems, cybersecurity breaches erode public trust, Wright said.

Beyond water systems, hackers may target data centers and energy infrastructure, such as oil and gas pumping sites or virtual power plants, Wright explained. She argued that the greatest impact of these attacks is on the public’s trust and that adversary groups “like to cause questions about the certainty of infrastructure services.”

Once hackers enter a water infrastructure system, they may be able to adjust the amount of water or chlorine in the system, operate valves, and even control dams or well pumps, according to Dr. Thomas Hyslip, an assistant professor of instruction at the University of South Florida (USF) who led cybercrime investigations at federal agencies for 23 years.

“Worst case scenario would be they hack the system, and they oversaturate the system with chlorine, or they turn the water off,” Hyslip told Heartlander News. Small communities tend to be more vulnerable to cyberattacks as they have limited budgets and few cybersecurity experts on staff, Hyslip noted.

Hyslip explained that utilities can remove attackers by disconnecting compromised devices from the internet and then implementing a firewall. The way hackers have recently gained access to American critical water infrastructure is by targeting the operational technology (OT) systems, particularly the programmable logic controllers (PLCs), which regulate water flow and disinfectants. PLCs are not supposed to be directly accessible from the internet, Hyslip said.

An Iran-affiliated hacker group was also able to shut down a power plant in the U.K. for four days in July through hacking its PLCs, according to multiple reports.

The public discovery of the cyberattacks on U.S. water systems began when Minnesota IT Services announced that hackers targeted over 30 community water systems on July 26 and 27. The Federal Bureau of Investigation (FBI) and the Environmental Protection Agency (EPA) released a joint statement on July 30, advising water and wastewater utilities to disconnect PLCs from public-facing internet.

The EPA, FBI, the Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) warned the water sector in April that Iran-affiliated cyberattacks posed an urgent and ongoing threat, noting that federal investigators were monitoring the issue.

The Trump EPA announced on Aug. 18 that it would award $10.8 million for training in the water sector, noting the vitality of preparing workers to deal with emerging cybersecurity threats.

Additionally, Democratic Sens. Amy Klobuchar of Minnesota and Adam Schiff of California introduced legislation on Aug. 13 aimed at strengthening infrastructure resilience and directing the EPA to earmark more funding for cybersecurity purposes.