Live updates and results from primary election night

MPR News helps you turn down the noise and build shared understanding. Turn up your support for this public resource and keep trusted journalism accessible to all. 

Turn Up Your Support

On a recent Monday morning in Braham, Minn., a local water operator made an unsettling discovery — the pump at the treatment plant wasn't working, threatening the flow of water to people's homes.

While investigating the root cause, crews took the plant offline, and the city 

 Braham's 1,700 or so residents to conserve water while they drew on a backup supply stored in a local tank.

It only took a couple of hours for workers to 

 after taking manual control of the pump. The self-proclaimed homemade pie capital of Minnesota still hosted its annual 

 celebration at the Park Cafe just days later.

But what Braham officials quickly learned, after connecting with Minnesota state IT teams, was that they were not alone in the outages. The 

 against industrial technology nationwide, and cybersecurity experts and federal officials suspected Iran may be to blame.

It's nothing new. Adversaries, including Iran, have been targeting U.S. critical infrastructure for years, to steal data or cause disruptions. Once inside, they can ransom the data to make money or threaten access to and trust in critical resources, from water and power to transportation and their bank accounts. "Everything's connected to the internet in one way or another," Nate George, the mayor of Braham, told NPR in an interview. "It's not Braham in particular that's being targeted. It's the internet access points and the vulnerable technology," George, a U.S. Air Force reservist, continued.

While the hackers failed to compromise the water supply, they succeeded in inspiring headlines and provoking uncertainty. And the scope, scale and real-world impacts of the attacks, like the one in Braham, have been remarkable even to the experts.

"I can't recall a time when there's been this many targets at once with operational impact," said Rob Lee, the co-founder and CEO of Dragos, a cybersecurity firm focused on industrial technology. Lee told NPR he's aware of victims of this recent spate of attacks outside the water sector, as critical infrastructure operators tend to rely on the same technology. It's something Lee has been 

Local and federal officials are looking to get their arms around what happened, help critical infrastructure operators secure their systems, reassure the public and prepare for the future for the more than 150,000 water and wastewater treatment systems in the U.S. — because the next wave of attacks could be worse.

"It appears this is a shot across the bow from Iran," Jake Braun, the former White House acting principal deputy national cyber director during the Biden administration, told NPR.

Between July 26 and July 28, several local authorities in Minnesota let citizens know about problems at community water plants from Braham to Maple Plain, Minn., where officials declared a brief state of emergency before 

 that "the immediate threat to public health, safety and welfare had been addressed."

Cities and towns across the country began to join their ranks. In Clayton County outside Atlanta, 

local officials issued a brief "boil water" advisory

 after a pump station failure was detected in the middle of the night. There were other outages in New Jersey and Michigan.

A cybersecurity information-sharing organization for the water sector, WaterISAC, was quick to convene a call for its 400 or so members across community water systems to disseminate intelligence from the federal government about the attacks. The EPA followed up with a publicly available webinar "to discuss an urgent operational matter dealing with cyber threats to the water sector."

then confirmed that at least seven states 

suffered similar attacks on water and wastewater facilities. Their investigation is ongoing.

The scope and scale could be much larger. Beyond Lee of Dragos mentioning victims outside the water sector, one state IT official who requested anonymity because they weren't authorized to comment on ongoing investigations, said there's still concern about the transportation and energy sectors being impacted by these attacks.

"I think that we have to assume that this attack is national in scope," said Braun, now the executive director of the Cyber Policy Initiative at the University of Chicago.

The U.S. government hasn't officially said yet who they think is responsible for the latest attacks on the water sector.

But it wouldn't be the first time nation-states have disrupted critical services for geopolitical reasons. Starting in 2015, Russia notably

 on Ukrainian power grids, plunging residents into darkness before ever launching a full-scale invasion.

Iranian-linked hackers have gone after U.S. power and water before.

For example, in 2023, an Iranian-linked hacktivist group 

 and defaced industrial machines in a water facility in Aliquippa, Pa. The machines, some of whose components were made in Israel, were manipulated to display anti-Israel messages during the war between Israel and Hamas.

The Department of Homeland Security's Cybersecurity and Infrastructure Security Agency has published a 

 about Iranian-linked hackers looking for vulnerabilities in industrial machines like those found in the water sector. That advisory first came out in April, and the authors updated it just days before this recent spate of attacks.

Michael Crean of cybersecurity firm SonicWall tells NPR that his company has seen a recent "spike" in bad actors "scanning" the internet for vulnerable devices, "trying to find potential weaknesses out there and see how they can exploit it." He said the team saw a similar spike in March before hackers with ties to Iran 

 American medical technology company Stryker, which resulted in data destruction.

"We're seeing somebody run their proof of concept," Crean said. "You know, what is it that you can do to … scare the American people? Water is one of those things," he said. "It's a necessity of life."

Neither the Iranian government nor the well-known Iranian hacktivists groups, including one called Cyber Av3ngers, the group linked to the Aliquippa water attacks, has taken credit for the recent wave of water attacks.

However, one cybersecurity expert who requested anonymity to discuss sensitive information told NPR there's intelligence linking the recent activity to the Iranian Revolutionary Guard Corps. "It was opportunistic, but was almost certainly a result of the war," the expert told NPR.

Braun, the former White House acting principal deputy national cyber director, has been working with hacking conference DEF CON and the National Rural Water Association to pilot a program called Project Franklin, bringing expert volunteers to rural water facilities to prepare for attacks just like this.

During an interview with NPR, he said there are several reasons Iran might want to launch these attacks beyond scaring the average American.

"Iran is targeting three things," said Braun. "Number one, it's showing the administration they can shut off water to our military assets … then, it's showing they can shut off the water to a key economic asset, our data centers," he said, referring to the engine behind frontier AI technology.

"Finally, it's in the middle of a war that the country is deeply divided over," Braun said. "It's telling the administration that they can undermine trust from the U.S. population that the U.S. government is capable of providing even basic services like water."

Parts of the water industry have already been thinking about this problem. Last September, NPR interviewed Chris Hughes, one of two water and wastewater operators in Cavendish, Vt., who was part of Braun's pilot program. "It's scary that I'm the only door between you know, the Iranians, and our water system," Hughes 

Industrial operators like Hughes deal with all kinds of challenges, from storms and natural disasters to technical failures and squirrels chewing through wires. Experts like Hughes say it might be difficult for bad actors to actually "poison" the water remotely. But talking to cybersecurity experts opened his mind to all kinds of possibilities, like a hacker causing a pipe to explode by fluctuating the water pressure.

There's a lot of damage hackers could do, particularly if industrial machines are connected to the internet. Technology helps some operators monitor their systems remotely and become more efficient, but it can expose insecure devices to bad actors a world away.

"I've been in the field for 28 years, I love technology," said Brandon Huston of the Minnesota Wastewater Operators Association. "But I purposefully have not put that into my wastewater system," he continued. He said it would be too expensive in time, money, and expertise to keep those systems updated and secure. "Every city's got vulnerabilities," he explained.

Securing critical infrastructure is a unique challenge, because industries from water to power rely on the same aging, specialized technology that can't easily be replaced, patched, or secured, explains Patrick Gillespie, a security expert who specializes in what's called operational technology at GuidePoint Security.

Operational technology, or OT, monitors and controls physical processes in the real world, rather than software which runs virtual programs like email or word processing. "This technology is decades old," Gillespie said.

"The equipment that opens valves and doses chemicals runs on small industrial computers," explained Mike Searight, the former chief information officer for the city of Waco, Texas and adviser for cybersecurity firm Elisity. These devices "can't be updated on demand," he said, "because the manufacturer has to certify the fix, [and] you may have to take the plant offline. Sometimes, no fix exists."

"Water isn't data. Breach a billing system and it costs money … breach a treatment plant and people get sick, or untreated sewage ends up in a river," Searight said.

During this latest series of attacks on the water sector, bad actors 

 They targeted devices that were exposed to the open internet with no additional protections, devices whose default username and password were never changed, for example, information that's often leaked online and is easy to find or guess.

 to prevent these basic attacks, like changing the default credentials, taking their industrial machines offline, disconnecting industrial machines from the rest of their business networks, and installing strong access controls and firewalls.

But future attacks might not be so easy to detect, stop, and recover from.

 about the threat posed by a Chinese-linked hacking group they call Volt Typhoon, a stealthy actor that's been burrowing into U.S. critical infrastructure and hiding there for years, maintaining that access to potentially wreak havoc in the event of a conflict like a Chinese invasion of Taiwan.

It's something Braham Mayor George says he's thinking about, using the skills he's learned in strategic planning in the U.S. Air Force Reserve.

"Chinese military officers have written playbooks about this," he said. "It's called unrestricted warfare…[It's] attacking the electrical grid, shutting down street lights, shutting down airports, things of that nature. It's all meant to not necessarily cause damage…but panic, or hype, or whatever's going to distract the government from what it's trying to do overseas," George said.

The recent attacks on the water sector could serve as motivation to prepare for the worst-case scenario.

"There's nothing that we can do to stop the threat actors from approaching and targeting assets in America any more than we can mitigate or stop a hurricane," said Kevin Morley, the head of federal relations for the American Water Works Association, or the AWWA, during an interview with NPR. "So we manage vulnerabilities and consequences … our ability to recover and respond to it will improve with time."

He said the quick response to the recent spate of attacks demonstrated the power of timely information sharing across federal, private and state and local partners. But the water sector needs more resources to improve its security baseline. In a letter to Congress after the nationwide attacks, the AWWA 

 increased federal funding for cybersecurity across the sector.

More water operators could take advantage of intelligence sharing from WaterISAC, as the organization is 

 the National Rural Water Association to make it easier and more affordable – particularly for those who serve under 10,000 people. "We're looking for new members to join, to be able to get the information from us before they see it in the news," Jennifer Lyn Walker, the director for Infrastructure CyberDefense at WaterISAC told NPR.

And Braun and his partners on Project Franklin are 

 called the Water Watch Center to give small utilities more support. Braun tells NPR their goal is to distribute resources through managed service providers, the third-party companies that already provide security solutions to the sector. They're also working with Vanderbilt University on a project funded by DARPA, the Defense Advanced Research Projects Agency, a wing of the Pentagon that supports innovative defense research, to train AI agents to defend operational technology in the water sector from attackers in real time.

Despite these efforts nationwide to get the right tools and education into the hands of water operators, the scale of the problem is staggering.

NPR reached out to representatives from state IT systems and cybersecurity and emergency response teams across the country. While not every office responded, a common theme of conversation emerged.

They say there's still a lot of work to be done to get visibility into local systems and hunt for hackers, and the chronically underfunded water sector in particular doesn't have the resources or the expertise to do it on their own.

Meanwhile, that problem has only gotten more challenging to deal with after the Trump administration 

 the federal cybersecurity workforce in a sweeping effort to reduce the size of the federal bureaucracy.

"California avoided an impact in this instance, but that should not create a false sense of security," wrote a spokesperson for the California Governor's Office of Emergency Services in response to questions from NPR. "Federal cuts to the nation's cybersecurity workforce and critical programs have weakened the partnerships, threat intelligence, and technical support that help protect essential services across the country," they concluded.

Braun tells NPR that ultimately, in order for efforts like Project Franklin to succeed at scale, there will need to be federal funding. "We can't fund it with philanthropy forever," he said. "We're designing it so the federal government can step in and fund it to deliver security everywhere."

Lee of Dragos thinks it will take more than a devastating cyberattack as motivation to solve this problem, given the number of times the sector has been targeted already.

"I think it's going to require a fully appreciated stance by senior government officials that we need to lead the discussion, regardless of local politics. And that's going to be hard," he said.

"How do you get out in front of people who are already upset about data centers, price raises, and feeling left out of an economy in a country that doesn't feel like it's for everybody … and say, hey, by the way, China, Russia, and Iran, they want to hurt your kids. We're going to ask you to raise your electric bill by ten cents, your water bill by 15 cents, and we're going to modernize our infrastructure and try to take care of people. That's hard," Lee said.

"But until that level of leadership is taking place, I don't think another attack is going to get us there."

Politics and Government News

Homepage

International

Jenna McLaughlin

Author

A recent series of cyberattacks on U.S. water systems has exposed vulnerabilities across critical infrastructure during the Iran war.

Are hacks of U.S. water facilities a new front in the Iran war?

Go Deeper.

Like this?

News you can use in your inbox