\n<\/p>\n
Since the end of last month, several water utilities in the United States have been hit by cyberattacks, causing alarm in the country.\u00a0<\/p>\n
For years, water utilities<\/a> and other critical infrastructure facilities in the power sector<\/a>, for example, have been targeted by hackers, whether government-backed or individuals. What makes this recent series of attacks\u2014allegedly carried out by Iran\u2014particularly concerning was how widespread they have been, hitting targets in around a dozen states.\u00a0<\/p>\n The U.S. has more than 150,000 water systems<\/a>, some of them run by local companies. In theory, that should make it harder for hackers to target several facilities at the same time. But on the flip side, the companies running these systems may not have the resources or cybersecurity expertise needed to protect themselves.\u00a0<\/p>\n Cybersecurity experts have long believed that Iranian hackers target low-hanging fruit in opportunistic isolated attacks, so this hacking campaign could be a significant escalation.\u00a0<\/p>\n A lot has happened since news of the initial attacks broke two weeks ago. So we decided it was a good time to recap what we know so far, and what we don\u2019t.\u00a0<\/p>\n On July 28, Minnesota authorities announced<\/a> that water treatment plants in more than 30 communities were hit by coordinated cyberattacks.\u00a0<\/p>\n Two days later, the FBI said<\/a> water and wastewater utility companies in \u201cat least seven states\u201d reported incidents, and in some cases the attacks \u201cdegraded water operations.\u201d Since then, apart from Minnesota, there have been reported hacks against water facilities in Arkansas<\/a>, Georgia<\/a>, New Jersey<\/a>, and Michigan<\/a>.\u00a0<\/p>\n The short answer is: we don\u2019t know yet, but the number one suspect is the Iranian government.\u00a0<\/p>\n As of today, officially, the U.S. government has yet to name the culprit behind the coordinated wave of hacks.<\/p>\n However, the first incidents in Minnesota came days after the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned<\/a> that Iranian hackers were targeting internet-connected devices in water systems and the energy sector, without saying where those attacks were occurring. (CISA had originally published this warning in April, and updated it before the Minnesota attacks.)\u00a0<\/p>\n After the initial wave was uncovered in Minnesota, President Donald Trump said he did not think \u201cthere was an Iranian cyberattack.\u201d Instead, he blamed the state<\/a>, perhaps because it is run by democratic governor Tim Walz, who was chosen as Kamala Harris\u2019s vice president in the 2024 elections.<\/p>\n Trump\u2019s claim came a day after Wired reported<\/a> that the Water Information Sharing and Analysis Center, or WaterISAC, a nonprofit group that distributes cybersecurity information among the water sector, told its members that the recent attacks \u201caligned\u201d with the hacking campaign CISA warned of\u2014effectively accusing the Iranian government.\u00a0\u00a0<\/p>\n Earlier this week, The Washington Post reported<\/a> that U.S. intelligence agencies \u201care confident\u201d that Iran, and in particular the Islamic Revolutionary Guard Corps (IRGC), is responsible. The attribution isn\u2019t public yet, according to the paper\u2019s sources, because the agencies are not sure which specific unit within the IRGC was responsible, and also because officials may be reluctant to contradict Trump\u2019s claim.<\/p>\n Iranian government hackers have a history<\/a> of targeting critical infrastructure in the U.S., and it\u2019s possible that these attacks are part of its strategy to retaliate against the country because of the six-month-long war.\u00a0<\/p>\n Until now, Iranian hackers had had only limited success in their cyberattacks against U.S. targets. In March, a hacktivist group called Handala disrupted the operations<\/a> of medical tech giant Stryker. The U.S. government later accused Handala of being operated<\/a> by Iran\u2019s Ministry of Intelligence and Security (MOIS). Then, the group claimed responsibility<\/a> for hacking the personal Gmail account of FBI director Kash Patel.<\/p>\n The reality is that some systems inside critical infrastructure facilities are exposed to the internet and relatively easy to find. Earlier this month, cybersecurity firm Forescout reported finding<\/a> more than 2,800 controllers in U.S. water systems exposed online. If a system is exposed, it doesn\u2019t automatically mean hackers can take over control and cause real-world effects. But that has happened in some isolated cases in recent attacks.<\/p>\n The FBI said some of the cyberattacks around the country caused loss of pressure, which \u201ccould potentially allow untreated groundwater to seep into pipes,\u201d and flooding.\u00a0<\/p>\n The town of Braham in Minnesota, one of the first ones to report an incident, had to take<\/a> its water plant offline for a few hours<\/a>, urging its around 1,700 residents to conserve water. The city of Maple Plain, also in Minnesota, briefly declared<\/a> a state of emergency. In a county outside Atlanta, Georgia, local officials briefly told residents<\/a> to boil water before using it as a precautionary measure.\u00a0\u00a0<\/p>\n The worst effect, however, may be psychological. These attacks have been widely covered in national and local press, causing people to worry about the safety of a fundamental and basic need like water. That may very well be part of the hackers\u2019 goals: to spread panic and fear.<\/p>\n<\/div>\n When you purchase through links in our articles, we may earn a small commission<\/a>. This doesn\u2019t affect our editorial independence.<\/em><\/p>\nWhere have there been attacks?<\/strong><\/h2>\n
Who is behind the attacks?<\/strong><\/h2>\n
What effects have the attacks had?<\/strong><\/h2>\n