EPA: Iran, China, Russia Are Targeting Water Utilities

Cyberattacks against water utilities across the country are becoming more frequent and more severe, the Environmental Protection Agency warned Monday as it issued an enforcement alert urging water systems to take immediate actions to protect the nation's drinking water. More, from the AP:

• About 70% of utilities inspected by federal officials over the last year violated standards meant to prevent cyberthreats, the agency said. Officials urged even small water systems to improve protections against cyberattacks, noting that recent assaults from adversarial nation states like Russia and Iran have impacted water systems of all sizes.

• Some water systems are falling short in basic ways, the alert said, including failure to change default passwords or cut off system access to former employees. Because water utilities often rely on computer software to operate treatment plants and distribution systems, protecting information technology and process controls is crucial, the EPA said.
• Possible impacts of cyberattacks include interruptions to water treatment and storage, damage to pumps and valves, and alteration of chemical levels to hazardous amounts, the agency said.
• Recent attacks are not just by private entities—many have government backing in a bid to derail the supply of safe water to homes and businesses. McCabe named China, Russia, and Iran as the countries that are "actively seeking the capability to disable US critical infrastructure, including water and wastewater."

(More cyberattack stories.)