Key Takeaways
- Multiple states and over 30 water systems have suffered a coordinated cyber attack that altered device IP addresses and passwords, disrupting monitoring and control.
- The FBI and EPA issued a joint Public Service Announcement urging utilities to isolate PLCs from the internet, enforce strong unique passwords, and use access‑control lists.
- While investigators have not confirmed the source, speculation points to possible Iranian involvement, a claim questioned by former President Trump.
- New York State has expanded its cybersecurity funding for water utilities, allocating $9 million to 153 local projects under the SECURE (Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements) program.
- State officials stress that the funding targets smaller systems lacking staff and financial resources, aiming to close cybersecurity gaps and ensure continuous, 24/7 protection of drinking‑water infrastructure.
Overview of the Nationwide Water System Cyber Attacks
In recent weeks, seven states and more than thirty water utilities across the United States have reported falling victim to a cyber intrusion that compromised their operational technology. Attackers gained remote access to internet‑facing devices, subsequently changing IP addresses and passwords. This manipulation resulted in a loss of monitoring and control functionality, leaving operators unable to oversee critical processes such as chemical dosing, pressure regulation, and treatment cycles. Although services were not completely shut down, the degradation of situational awareness raised significant concerns about the safety and reliability of drinking‑water supplies. The incidents have prompted a nationwide reassessment of cybersecurity posture within the water and wastewater sector.
FBI and EPA Public Service Announcement
Responding to the unfolding threat, the Federal Bureau of Investigation and the Environmental Protection Agency released a joint Public Service Announcement last week. The advisory specifically targets municipalities and critical‑infrastructure owners responsible for water and wastewater utilities. It outlines the observed tactics—remote exploitation of internet‑exposed programmable logic controllers (PLCs), credential changes, and network disruption—and prescribes concrete mitigation steps. Recommendations include removing PLCs from direct internet exposure by placing them behind secure gateways and firewalls, establishing strong, unique passwords for all devices, and implementing access‑control lists (ACLs) that permit communication only between authorized control‑system components. The agencies stress that these measures are essential to reduce the likelihood of similar compromises.
Details of the Attack Methodology
Investigators have revealed that the attackers initially scanned for exposed PLCs and related human‑machine interfaces (HMIs) that were inadvertently reachable from the public internet. Once a vulnerable device was identified, they employed brute‑force or credential‑stuffing techniques to gain administrative access. After logging in, the threat actors altered the device’s network configuration—changing its IP address and resetting passwords—to lock out legitimate administrators. This manipulation severed the link between the control system and supervisory monitoring tools, effectively blinding operators to real‑time process data. The loss of visibility hindered timely response to anomalies, increasing the risk of unsafe water conditions if malicious actors chose to manipulate treatment parameters further.
Speculation on Attribution and Political Reaction
While the forensic analysis remains ongoing, some intelligence sources have speculated that the attacks could be linked to Iranian state‑sponsored actors, citing similarities in tactics, techniques, and procedures observed in previous campaigns targeting critical infrastructure. Former President Donald Trump publicly questioned these assertions, suggesting that the attribution might be premature or politically motivated. Nonetheless, officials emphasize that definitive attribution requires extensive evidence and that the immediate priority is strengthening defenses regardless of the adversary’s identity. The uncertainty surrounding the source underscores the need for a resilient, assumption‑based cybersecurity strategy that does not rely solely on pinpointing a particular threat actor.
New York’s Proactive Cybersecurity Funding Initiatives
Even before the latest wave of attacks, New York State had begun addressing water‑utility cybersecurity. In March, the governor’s office announced a series of grants and regulatory measures designed to bolster the sector’s resilience. On Monday, the state unveiled an additional tranche of funding, allocating $9 million to support 153 local water projects. This injection of resources forms part of a broader effort to ensure that utilities—especially smaller, under‑resourced systems—can implement essential cybersecurity controls. Acting Chief Cyber Officer Michaela Lee noted that the timing aligns with the state’s 2023 cyber strategy, which anticipated the need to identify and remediate gaps in real time as threats evolve elsewhere.
Statements from New York State Chief Cyber Officer
Michaela Lee emphasized that the governor’s proactive stance reflects a long‑term commitment to safeguarding public health infrastructure. She stated, “Governor Hochul has been very proactive on this, so this is actually something that we had laid out in our 2023 cyber strategy for the State.” Lee highlighted that the recent incidents in other jurisdictions serve as a valuable lens through which New York can assess its own vulnerabilities. By directing funding toward identified weaknesses, the state aims to demonstrate to residents that substantial behind‑the‑scenes work is underway to keep water supplies safe and secure. Her remarks underscore the dual purpose of the grants: immediate remediation and ongoing vigilance.
Perspective from the American Water Works Association (AWWA) New York Section
Jenny Ingrao, Executive Director of the AWWA New York Section, echoed the sentiment that cybersecurity readiness varies widely across the state’s utilities. She observed that many larger systems possess competent IT and cybersecurity teams, equipped with the tools and protocols necessary to thwart attacks. In contrast, smaller utilities often lack the staffing and financial means to implement comparable defenses. Ingrao stressed that “one size does not fit all” when it comes to cybersecurity, advocating for individualized vulnerability assessments and tailored safeguards. This approach, she argued, is essential to protect all New Yorkers regardless of the size or location of their water provider.
Comments from AWWA New York Section Chair on Funding Impact
Ken Naugle, Chair of the AWWA New York Section, welcomed the new $9 million allocation as a critical lifeline for the most vulnerable systems. He explained that the funds will enable utilities with the greatest needs to launch cybersecurity programs, acquire necessary hardware and software, and establish baseline hygiene practices. Naugle cautioned, however, that cybersecurity is not a one‑time effort; utilities must maintain continuous, 24/7 monitoring and incident‑response capabilities moving forward. For those systems that previously had no starting point, the grant represents a meaningful step toward bridging the existing resource divide and fostering a more uniform security posture across the state.
Description of the SECURE Program and Its Goals
The funding is administered under New York’s “SECURE” initiative—Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements. SECURE aims to create a layered defense strategy that combines technical controls, workforce training, and regulatory oversight. By providing grants for risk assessments, multi‑factor authentication, network segmentation, and continuous monitoring tools, the program seeks to elevate the baseline security of water utilities statewide. Additionally, SECURE encourages the adoption of incident‑response planning and regular exercises, ensuring that utilities can react swiftly should a breach occur. The ultimate objective is to guarantee that every New Yorker receives drinking water that is not only clean but also protected from cyber threats that could compromise public health.
Conclusion: Ensuring Safe and Secure Water Supplies
The recent cyber incidents affecting water systems nationwide serve as a stark reminder of the growing intersection between critical infrastructure and digital threats. New York State’s proactive financial commitment, guided by data‑driven recommendations from federal agencies and informed by sector‑specific expertise, illustrates a comprehensive approach to mitigating risk. Through the SECURE program and targeted support for smaller utilities, the state endeavors to close existing gaps, enforce consistent cybersecurity hygiene, and maintain the resilience of its water supply. As the threat landscape continues to evolve, sustained investment, vigilance, and collaboration among government, utility operators, and industry associations will be vital to preserving the safety and reliability of the water that flows into homes and businesses across the Empire State.