Key Takeaways
- Cyber attackers, possibly linked to Iran, compromised programmable logic controllers (PLCs) in water systems across more than seven states by altering IP addresses and passwords.
- The intrusion prevented operators from monitoring or controlling the infrastructure, creating risks of flooding, pressure loss, and possible contamination of drinking water with untreated groundwater.
- Baltimore’s Department of Public Works (DPW) stated it continuously safeguards its water and wastewater infrastructure through best‑practice monitoring, threat evaluation, and collaboration with local, state, and federal partners, though it does not disclose specific cybersecurity measures.
- Anne Arundel County’s DPW declined to comment on its protections but said it is taking proactive steps against cyber threats.
- The attacks follow a July 2024 update to an April warning from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) about Iranian‑affiliated cyber activity targeting operational technology devices.
- Expert Charles Harry of the University of Maryland noted that while the incident was not a large‑scale emergency, manipulating PLCs can have serious physical consequences and could affect other sectors such as electricity, garbage disposal, or advanced manufacturing.
- Federal agencies recommend removing PLCs from direct Internet exposure, enforcing strong passwords, and scanning critical infrastructure for vulnerabilities.
- Although unconfirmed, the timing and nature of the breach make Iranian government or activist involvement plausible as a means of exerting pressure on the United States.
Overview of the Cyber Attack
In late July 2024, federal authorities disclosed that a series of cyber intrusions had compromised water‑system infrastructure in more than seven U.S. states. The attackers, whose origins are suspected to be Iranian‑based, gained unauthorized access to programmable logic controllers (PLCs) that automate critical functions such as valve operation, pump control, and pressure regulation. By changing the devices’ IP addresses and passwords, the intruders effectively locked out legitimate operators, preventing them from viewing real‑time data or issuing control commands. This type of intrusion is particularly concerning because PLCs sit at the intersection of cyber and physical domains; compromising them can directly alter the behavior of essential utilities.
Details of the Attack Methodology
The attackers employed a relatively straightforward but effective technique: they scanned for PLCs of a specific make and model that were reachable over the Internet. Once identified, they either logged in using default or weak credentials or exploited the absence of any password protection. After gaining access, they reconfigured the network settings—changing the IP address so that the device no longer responded to its legitimate management interface—and replaced the administrator password with one unknown to the utility’s staff. Consequently, when operators attempted to connect via supervisory control and data acquisition (SCADA) systems, they encountered connection failures or authentication errors, effectively locking them out of the control loop.
Potential Impacts on Water Systems
When PLCs cannot be accessed or commanded, the automated safeguards that maintain water pressure, prevent backflow, and manage treatment processes may fail or operate on stale settings. The immediate hazards include unexpected pressure drops that could cause pipe collapses or surges that lead to flooding, as well as the possibility of untreated groundwater infiltrating the distribution network if containment valves remain open or are incorrectly positioned. While the agencies noted that the effects of this particular incident did not persist long enough to trigger a major public‑health crisis, they emphasized that even short‑lived disruptions can erode public confidence, necessitate costly emergency responses, and, under different circumstances, escalate to contamination events or service outages affecting tens of thousands of residents.
Response from Baltimore Department of Public Works
Baltimore’s Department of Public Works (DPW) issued a statement affirming its ongoing commitment to protecting critical water and wastewater infrastructure. The agency highlighted its reliance on industry best practices, continuous monitoring, and active collaboration with local, state, and federal partners to detect and mitigate threats. DPW noted that it regularly evaluates emerging cyber risks and adjusts its defenses accordingly, a process described as strengthening its “cybersecurity posture.” Importantly, the department declined to divulge specifics about its defensive architecture, operational procedures, or the exact tools it employs, citing policy restrictions on sharing sensitive security details.
Anne Arundel County’s Position
In contrast, Anne Arundel County’s Department of Public Works opted not to comment on the particular measures it has in place to defend its water systems. A spokesperson indicated that the county is taking proactive actions to guard against cyber attacks but refrained from elaborating on the nature or scope of those initiatives. This reticence mirrors a common trend among municipal utilities, which often treat cybersecurity tactics as confidential to avoid tipping off potential adversaries.
Broader Context: US‑Iran Tensions
The intrusion occurred amid a protracted period of heightened friction between the United States and Iran. Iranian officials have publicly disputed claims by the Trump administration that the two nations are resuming diplomatic talks, contributing to an atmosphere of mutual suspicion. Security analysts have observed that Iran has increasingly turned to cyber operations as a low‑cost, high‑impact means of projecting influence, particularly when conventional military options are constrained. The targeting of essential civilian infrastructure such as water systems fits a pattern whereby state‑linked actors seek to generate pressure on an adversary by threatening the reliability of services that directly affect daily life.
Expert Analysis by Charles Harry
Charles Harry, an associate research professor at the University of Maryland’s School of Public Policy and College of Information, provided insight into the technical and strategic dimensions of the attack. He emphasized that PLCs are integral to the operation of physical processes; compromising them enables a hacker to “remotely not just access, but then manipulate physical systems.” Harry illustrated the danger by noting that an attacker could shut off power to a treatment plant or open a valve that should remain closed, thereby causing immediate operational hazards. He estimated that resetting a system after a password change could take a few hours, while altering IP addresses might necessitate a site visit, potentially leaving the equipment offline for up to a day. Although he characterized the incident as “not a trivial thing,” Harry cautioned against overstating its scale, describing it as more than a mere annoyance but not yet a large‑scale emergency. He also warned that the same tactics could be applied to other sectors reliant on PLCs, including electricity generation, waste‑management facilities, and advanced manufacturing plants.
Recommendations from Federal Agencies
Both the Federal Bureau of Investigation (FBI) and the Environmental Protection Agency (EPA) issued guidance aimed at reducing the likelihood of similar intrusions. Their primary recommendation is to segregate PLCs from direct Internet exposure, ensuring that these devices communicate only with trusted, predetermined endpoints within a segmented network. Agencies also urged utilities to implement strong, unique passwords on all programmable controllers and to disable default credentials wherever possible. Additionally, they advocated for regular vulnerability scanning of critical‑infrastructure assets, patch management for firmware, and the adoption of multi‑factor authentication for remote access points. By following these measures, operators can significantly raise the difficulty for adversaries seeking to exploit poorly secured industrial control systems.
Conclusion and Ongoing Vigilance
The recent cyber campaign against water‑system PLCs underscores the growing vulnerability of essential services to digital threats that can manifest in physical consequences. While the immediate effects of this particular episode were limited, the incident serves as a stark reminder that even modest manipulations of industrial control equipment can cascade into safety hazards, service disruptions, and public‑health risks. Municipal utilities such as Baltimore’s DPW are increasingly required to balance operational transparency with the need to safeguard defensive details, a tension that complicates public communication but remains necessary for security. Continued investment in network segmentation, robust credential management, and proactive threat monitoring—aligned with federal guidance—will be essential to prevent future attacks from moving beyond nuisance to genuine emergency. As geopolitical strains persist, the convergence of state‑sponsored cyber capabilities and critical infrastructure demands sustained vigilance from both government agencies and the utilities they oversee.