Cybersecurity and Local Critical Infrastructure
What this summer’s water system attacks tell us about local infrastructure
Over the last weekend of July, water and wastewater utilities across the country started reporting the same kind of problem. Automated controls stopped responding, operators were locked out of equipment, and in some places pumps and treatment plants went offline. By early August, incidents had been reported in at least 12 states.
The details varied from place to place. In Georgia, the Clayton County Water Authority saw a pressure drop that led to a boil water advisory for its 300,000 customers, with service restored within hours. Michigan’s environmental agency confirmed that nine municipal water systems had reported activity matching the federal warnings. In Minnesota, more than 30 community water systems were targeted over two days, and in the small city of Braham the attack briefly shut down the well and treatment plant before public works crews had it running again in about two hours.
Minnesota’s response offers a clear example of coordination at work. The state’s IT agency activated its incident response right away and brought public safety, public health, and federal partners together with the affected utilities. Plymouth’s IT team disconnected the cellular equipment at its water towers and lift stations to stop the attack while crews kept things running manually. State officials reported no impact on drinking water quality and no boil water advisories anywhere in the state.
The attacks followed months of federal warnings. Since April, federal agencies had cautioned that actors affiliated with Iran were exploiting internet connected controllers across water, energy, and government systems, and a similar campaign in 2023 reached a water authority in Aliquippa, Pennsylvania, by exploiting default passwords on exposed devices. This summer’s attacks have not been formally attributed, and the federal investigation is ongoing.
Much of this risk sits outside the IT department. The controllers targeted this summer are the same kind that run lift stations, pump houses, building systems, and municipal electric utilities. Many were installed years ago so a small crew could watch over equipment spread across a service area, which makes managing them a responsibility for the people who lead public works and utilities as much as for IT.
The response this summer also showed what preparation makes possible. Where utilities knew their systems, had manual procedures ready, and had partners in place, service came back within hours and residents saw little disruption. That kind of resilience is something any agency can plan for.
Fractional Source has partnered with Sourcewell Ventures to scale our K12 cybersecurity pilot over the next few months, providing free assessments and exercises to local governments. If you are interested, please contact us at [email protected], or reach the Sourcewell Ventures team at [email protected].
James
