Staff Reports
The Environmental Protection Agency (EPA) recently called upon water utilities to take immediate action to safeguard public drinking water supplies from cyberattacks, which have been increasing in frequency and severity. The EPA highlighted that about 70% of the water utilities inspected in the last eight months have violated basic standards designed to protect against breaches, with cyber intrusions primarily originating from China, Russia, and Iran.
The EPA emphasized simple yet crucial measures that water providers can take to enhance cybersecurity, such as changing default login passwords, enforcing the use of different login information for staff, and revoking access for former employees. The agency cautioned that by gaining access to a water system, hackers could cause significant disruptions to water treatment, distribution, and storage, as well as manipulate chemical levels to dangerous extents.
The EPA asked water utilities to take immediate action to defend against cyberattacks on public drinking water supplies, citing an uptick in the frequency and severity of attempted intrusions, primarily by hackers in China, Russia, and Iran. https://t.co/y1tVRChr9N
— Washington Examiner (@dcexaminer) May 21, 2024
Of note are instances of cyberattacks on water systems, including an attack on a small Pennsylvania water provider by an Iranian-based hacking group, attacks on three Texas water systems by a known Russian “hacktivist” group, and multiple incidents where state-sponsored Chinese hackers targeted critical infrastructure and drinking water since 2021.
As a response and to aid water systems in identifying threats and developing strategies for protection, the EPA has established a Water Sector Cybersecurity Task Force. Additionally, EPA Administrator Michael Regan and White House national security adviser Jake Sullivan have urged states to outline plans to shield their public water systems from cyberattacks.
The EPA has emphasized the severity of cyber threats and signaled its readiness to impose civil or criminal penalties on water systems that fail to implement fundamental digital security measures. This alert underscores the EPA’s commitment to addressing cybersecurity risks in public water systems.
