The Environmental Protection Agency on Monday alerted water utilities to the increased risk of cyberattacks against their infrastructure. It warned such attacks are becoming more severe and happening more often, which can put drinking water at risk for Americans all over the country.
Federal officials found some 70% of water systems nationwide had shortcomings that made them vulnerable to cyberattacks, some of them as simple as unchanged default passwords on computer control systems.
The threat comes not just from independent attackers but also from state-sponsored hackers. EPA Deputy Administrator Janet McCabe warned China, Iran and Russia are all probing U.S. infrastructure for weaknesses that they can exploit.
Data Privacy and Cybersecurity
US infrastructure is vulnerable to Chinese cyberattack, officials warn
One recent attack targeted equipment manufactured in Israel as a response to Israel's war against Hamas, ultimately forcing a utility company in small-town Pennsylvania to run its automated pumps manually.
Attackers affiliated with Russia have tried to knock utility services in Texas offline, and a group linked to China has compromised a wide range of critical infrastructure, including fresh water.
The renewed warnings are part of the Biden administration's wider effort to improve infrastructure safety. Officials have charged water utilities to better defend themselves, whether that's through simple measures like choosing better passwords or through better cybersecurity training and hiring.
The EPA says it will continue training and assessments for utilities, and says it will turn to civil or criminal prosecution if its inspections find big enough risks.
“We want to make sure that we get the word out to people that hey, we are finding a lot of problems here,” McCabe said.
