U.S. water utilities targeted in coordinated cyberattacks

Coordinated cyberattacks have targeted multiple United States water utilities, affecting more than 30 systems in Minnesota and causing operational degradation in at least seven states, according to FBI and state reports. While no disruptions to drinking water supplies have been reported, the incidents primarily exploited remote-management equipment and internet-connected operational systems.

In response to these vulnerabilities, Senators Schiff and Klobuchar have introduced the Water Cyber Shield Act. The proposed legislation would authorize the Environmental Protection Agency (EPA) to conduct cybersecurity assessments of water systems and mandate corrective actions for significant vulnerabilities.

Research from Georgia Tech’s Cyber-Physical Security Lab highlights that the water sector is among the most vulnerable critical infrastructure lifelines. Experts note that programmable logic controllers (PLCs), which automate essential services, are frequently exposed to the internet due to configuration errors or intentional remote-access requirements, leaving them susceptible to manipulation by attackers.