More than 100 water systems were hit in July cyberattacks

In July, malicious cyber activity targeted over 100 internet-exposed water systems across the United States, according to the Cybersecurity and Infrastructure Security Agency (CISA). This marks the first time the government has quantified the scale of these digital intrusions. The attacks, widely suspected to originate from Iran, targeted programmable logic controllers (PLCs) connected directly to cellular modems, a setup that can create significant security risks.

The intrusions occurred at small, rural utilities in at least a dozen states, including Minnesota, Michigan, Georgia, South Dakota, and New Jersey. Matt Hartman, the former acting head of cyber at CISA, emphasized the seriousness of the situation, noting the scale of the attacks rather than any single incident. John Gallagher of Viakoo, an OT and IoT cybersecurity provider, warned that while 100 systems represent only about 0.5 percent of US water utilities, these attacks could serve as test runs for larger-scale assaults.

Meanwhile, five US federal agencies cautioned that attackers are utilizing AI-generated exploitation scripts to breach internet-exposed Siemens S7 Series PLCs in various critical facilities. Despite suspicions of Iranian affiliation, the federal government has yet to attribute the attacks to any specific group. CISA has advised water-sector operators to disconnect PLCs from the internet, use VPNs or gateway devices for remote access, and strengthen password protection.