Major Warning Issued About Attacks on US Water Supply
Foreign hackers are actively targeting critical U.S. infrastructure, including water and wastewater systems, using AI-powered tools to identify vulnerabilities and access industrial control systems, federal cybersecurity officials warned Wednesday.
In a cybersecurity advisory, the Cybersecurity and Infrastructure Security Agency (CISA) and federal and international partners said threat actors are conducting reconnaissance against Siemens S7 Series programmable logic controllers (PLCs), widely used at water treatment plants, energy facilities, chemical plants and other critical infrastructure sites.
Attackers are using AI-generated exploitation scripts disguised as legitimate monitoring tools and scanning the internet for exposed PLCs running outdated software or lacking adequate protections.
The warning comes amid widespread cyber incidents targeting local water systems in multiple states in recent weeks, which cybersecurity experts suspect are linked to Iran.
CISA stressed that the threat is active, not theoretical. Successful compromises could disrupt industrial processes, damage equipment, cause safety incidents and affect critical services. The campaign targets water, wastewater, energy, chemical, commercial and other facilities, reflecting growing concerns about attacks on operational technology controlling real-world infrastructure.
Water systems are particularly attractive because they provide essential services and often rely on difficult-to-secure legacy equipment. An attack could disrupt treatment, affect service or require costly emergency responses.
The primary risk is to organizations operating internet-connected or outdated Siemens S7 PLCs, particularly poorly configured or insufficiently protected devices. A compromise could provide access to larger operational networks.
CISA urged operators to apply security mitigations, remove unnecessary internet exposure, update software and strengthen network protections.
Consumers face less immediate risk but should use strong, unique passwords and multifactor authentication, promptly install software and firmware updates, remain alert to AI-generated phishing emails, texts and calls, follow guidance from local water providers and emergency officials, and keep bottled water and basic necessities available for potential infrastructure outages.
