In the last two weeks, hackers have gotten into municipal water systems in more than a dozen states. Minnesota got hit first and hardest, with more than 30 water facilities targeted in a single weekend. Michigan and Georgia followed. Some plants lost pressure. Some flooded. Operators got locked out of the equipment that runs their own plant. Rapid City reported an incident on one of its wastewater lift stations, which puts this a lot closer to home than a headline out of Washington.
Nobody has officially named a suspect, though a foreign-linked group with a history of targeting exactly this kind of equipment is the leading theory. Who did it matters less than how they did it, because how they did it is a story we see play out in small and medium-sized businesses all the time.
How the door got left open
The equipment that runs a water plant, pumps, valves, pressure sensors, falls under what’s called operational technology, or OT. It works differently than a laptop or a file server, but the rule is the same: if it’s connected to the internet and nobody locked it down, someone will eventually find it.
That’s what happened here. Investigators say hackers found internet-facing industrial controls still running factory-default or weak admin passwords and walked straight in. From there they reset credentials, locked the real operators out, and started touching controls that were never supposed to be reachable by a stranger.
Why this isn’t only a water utility problem
For years we’ve explained modern security using what we call the Three Castles. Pre-COVID, a business had one perimeter firewall guarding one castle. Post-COVID, users, devices, and data each became their own castle, connected by tunnels, with no single moat protecting any of them. Operational technology, cameras, door access, industrial equipment, anything that runs the physical side of a business, is a fourth castle a lot of companies never think to defend at all.
That’s the exact gap the water system hackers found: nobody watching the OT side, nothing segmented away from the rest of the network, and equipment still running the password it shipped with.
If you inherited “IT” as a second job on top of your actual title, here’s the plain version: a flat network with a default password on a piece of connected equipment is a door, and it doesn’t matter whether that equipment runs a water plant or a walk-in cooler. It’s the single most common thing we find broken when we onboard a new client.
What actually closes that door
A few unglamorous things, in order:
- Segmentation. Cameras, industrial controls, and anything else connected to the network shouldn’t sit on the same flat network as the machines processing sensitive data.
- Real passwords. Every piece of connected equipment needs a credential that isn’t the one it shipped with.
- Actual monitoring. You can’t respond to an intrusion you can’t see. Watching both the IT and OT side means a breach gets caught in minutes instead of discovered after the flooding starts.
- A plan you already know. When an alert fires, the gap between a five-minute lockdown and a five-day scramble is whether someone already knows what happens next.
What we’re doing about it
We’ve been tracking this one closely since the first reports came out of Minnesota. Our team has sat in on the emergency briefings as CISA, the FBI, and the EPA update their advisories, and we’ve been working directly with our municipal water utility clients to walk through the recommended fixes: pulling exposed controllers off the open internet, resetting credentials, and tightening the OT side of their networks. It’s the same work we do for any client running connected equipment, just under a much brighter spotlight this month.
The takeaway
You don’t have to run a municipal water plant for this to apply to you. If your business has cameras, door access, industrial equipment, or anything else plugged into the network that isn’t a laptop, it’s worth checking whether it’s segmented and locked down the way the rest of your systems are.
If you’re not sure what your own network looks like on the OT side, that’s a quick thing to check on a call. Book a Discovery Call.
Sources:
- FBI/EPA Public Service Announcement, “Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-Facing Programmable Logic Controllers” (fbi.gov)
- EPA, FBI, CISA, NSA Joint Cybersecurity Advisory on Iranian-Affiliated Cyber Activity Targeting Water Systems (epa.gov)
- “Hackers targeted municipal water systems in 7 states this week, FBI says” (NBC News)
- “The number of states targeted in cyberattacks on water systems has jumped to 12” (Axios)
- “More US water systems struck by hackers” (Route Fifty)