CISA says hackers targeted over 100 US water systems in July

U.S. cybersecurity agency CISA said it has observed cyberattacks targeting over 100 internet-exposed systems across the U.S. water and wastewater sector, amid a wave of hacks targeting American critical infrastructure. The figure gives new context to the scale of ongoing cyberattacks on water providers in Michigan, Minnesota, and at least five other states. In an advisory, the federal agency, which oversees cybersecurity defense and critical-infrastructure protection, said the attacks have largely targeted programmable logic controllers (PLCs), which control physical systems and machinery across water providers, energy systems, and other critical infrastructure.

In recent weeks, hackers have targeted PLCs made by several manufacturers, including Rockwell, Schneider Electric, and, more recently, Siemens. CISA previously said the attacks are relying in part on AI tools that use public information to develop scripts capable of targeting vulnerable Siemens PLCs. The intrusions have had little effect on water or wastewater supplies to local communities but have caused outages and disruption as incident responders investigate the breaches; CISA previously reported that some intrusions let hackers modify affected PLCs to disable shutdown processes and alarms, potentially creating “unsafe conditions” without notifying operators. Many of the affected communities are in rural or isolated areas, where disruption to critical infrastructure can affect a large area of people.

Reports citing senior American officials say U.S. intelligence believes Iran is likely behind the largely opportunistic attacks on water providers, possibly in response to the U.S. and Israel-led war against Iran, but officials have fallen short of a concrete attribution. The intrusions have sparked broader concerns about the cybersecurity and resiliency of critical infrastructure across the United States. U.S. officials have separately warned in recent years that China-linked hackers have been planting destructive malware on critical infrastructure, ready to activate as a distraction in the event of an anticipated Chinese invasion of Taiwan, while Russia has also been linked to several cyberattacks on water providers and power and energy grids across Europe as part of a campaign seen as aimed at testing the NATO alliance.

Why it matters

A three-digit tally of exposed water-system intrusions, combined with attacks capable of disabling safety alarms, shows critical-infrastructure hacking has moved from theoretical risk to a recurring operational hazard for the utilities least equipped to defend against it.