Technology
Over 100 U.S. water systems targeted in July cyberattacks, CISA reports
The intrusions exploited internet-exposed control devices at mostly small, rural utilities across at least a dozen states.
The short version
- The Cybersecurity and Infrastructure Security Agency reported that more than 100 internet-exposed U.S. water and wastewater systems were targeted in July.
- The cyberattacks primarily impacted small, rural utilities across at least 12 states by exploiting programmable logic controllers connected directly to cellular modems.
- Federal agencies recently warned that attackers are now leveraging AI-generated exploitation scripts to breach critical infrastructure control systems.
- CISA has urged water utility operators to disconnect control equipment from the public internet and implement stronger access controls.
Key facts
- CISA announced that more than 100 internet-exposed U.S. water and wastewater facilities were targeted by digital intrusions during the month of July.[Slashdot]
- The cyberattacks frequently exploited programmable logic controllers (PLCs) connected directly to cellular modems, primarily affecting small, rural utilities.[Slashdot]
- Intrusions occurred across at least 12 states, with confirmed incidents in Minnesota, Michigan, Georgia, South Dakota, and New Jersey.[Slashdot]
- Five federal agencies issued a warning that hackers are using AI-generated scripts to target internet-exposed Siemens S7 Series PLCs at water, manufacturing, and energy facilities.[Slashdot]
- CISA recommended security measures including removing PLCs from the open internet, using VPNs for remote access, changing default passwords, and limiting access to approved IP addresses.[Slashdot]
What remains uncertain
- Federal and state officials have not formally attributed the July campaign to a specific group or country, although cybersecurity experts and officials widely suspect a link to Iran.[Slashdot]
- Officials have not publicly identified all of the dozen or more states where the targeted utilities are located.[Slashdot]