\n<\/p>\n
The Environmental Protection Agency is ramping up its inspections of critical water infrastructure after warning of \u201calarming vulnerabilities\u201d to cyberattacks.<\/p>\n<\/div>\n
The agency issued an enforcement alert<\/a> yesterday warning utilities to take quick action to mitigate threats to the nation\u2019s drinking water. The EPA plans to increase inspections and says it will take civil and criminal enforcement actions as needed. <\/p>\n<\/div>\n \u201cCyberattacks against [community water systems] are increasing in frequency and severity across the country,\u201d the alert<\/a> says. \u201cPossible impacts include disrupting the treatment, distribution, and storage of water for the community, damaging pumps and valves, and altering the levels of chemicals to hazardous amounts.\u201d<\/p>\n<\/div>\n \u201cCyberattacks against [community water systems] are increasing in frequency and severity across the country.\u201d<\/p>\n<\/div>\n<\/div>\n More than 70 percent of water systems inspected since September 2023 failed to comply with mandates under the Safe Drinking Water Act (SDWA) that are meant to reduce the risk of physical and cyberattacks, the EPA said. That includes failing to take basic steps like changing default passwords or cutting off former employees\u2019 access to facilities. Since 2020, the EPA has taken more than 100 enforcement actions for violations of that section of the SDWA.<\/p>\n<\/div>\n \u201cForeign governments have disrupted some water systems with cyberattacks and may have embedded the capability to disable them in the future,\u201d the enforcement alert says<\/a>. One example it cites is Volt Typhoon, a People\u2019s Republic of China state-sponsored cyber group<\/a> that has \u201ccompromised the IT environments of multiple critical infrastructure organizations,\u201d according to a Department of Homeland Security advisory issued in February.<\/p>\n<\/div>\n The EPA\u2019s enforcement alert asks utilities to follow recommendations for maintaining cyber hygiene, including conducting awareness training for employees, backing up OT \/ IT systems, and avoiding public-facing internet. <\/p>\n<\/div>\n It follows a letter<\/a> EPA administrator Michael Regan and national security advisor Jake Sullivan sent to state governors earlier this year warning them of cyber risks<\/a> to the nation\u2019s drinking and wastewater systems. It led to a March convening where the National Security Council asked each state to come up with an action plan to address those vulnerabilities by late June. <\/p>\n<\/div>\n