CISA Warns of Rising Water Utility Attacks as Minnesota Incidents Are Probed
Summary
CISA warned of increased attacks on water utilities and urged operators to remove internet-exposed PLCs and OT. Minnesota said over 30 systems were affected from July 26; password and IP changes caused boil-water notices and manual operations. Iran links remain under │[
Key points
- CISA reported a significant increase in malicious activity targeting water utilities and urged operators to remove publicly exposed PLCs and other OT assets from the internet.
- Minnesota’s state IT agency said more than 30 community water systems were affected by a coordinated cyberattack beginning July 26.
- CISA said intruders changed passwords and PLC IP addresses, locking out operators and disconnecting PLCs; reported effects included boil-water notices and sustained manual operations.
- Investigators are reportedly assessing possible Iran links. A WaterISAC memo, as reported by Wired, attributed the attacks to Iran, but CISA’s alert did not mention Iran.
- The FBI said utility companies in at least seven states reported PLC-related incidents. CISA, the FBI, and EPA are involved in the response.
- CISA advised water organizations to check external connections, including cellular modems that may not be documented or covered by routine scans.
Article Details
- Event Type
- CISA warning about increased cyberattacks targeting water utilities, alongside investigations into disruptions affecting Minnesota community water systems.
- Impact
- More than 30 Minnesota community water systems were reportedly affected. Attackers changed passwords and PLC IP addresses, locking out operators and disrupting operations; incidents resulted in boil water notices and sustained manual operations. The FBI said utility companies in at least seven states had reported PLC-related incidents.