At least seven states have been targeted for cyberattacks against water utilities, according to a notice released by the FBI. Building owners are being warned that operational technology devices and programmable logic controllers are being directly targeted.
Several states have reported that the treats have degraded water operations. Meanwhile, others have reported loss of pressure and flooding that could potentially allow for untreated ground water to seep into pipes. The extent of the impact depended on the type of function for which the PLC was configured, the equipment itself, the function the device supported and capability to switch to manual operations. This activity has resulted in boil water notices and sustained manual operations.
According to the release, cyber actors changed IP addresses and passwords after remotely accessing devices, resulting in a loss of monitoring and control functionality. The FBI and Environmental Protection Agency (EPA) recommend removing PLCs from direct internet exposure through secure gateway and firewalls, setting up strong and unique passwords and utilizing an access control list to allow only authorized communication between expected control system devices.
The FBI, EPA and CISA recommend the following activities to protect operations:
Mackenna Moralez is the managing editor for the facilities market and the host of the Facilities in Focus podcast.
