Increase in Cyberattacks Targeting U.S. Water Infrastructure Raises Concerns

<p>Recent cyberattacks on the water supply in the United States have shifted from financially motivated ransomware to attacks aimed at disrupting essential civilian infrastructure, according to senior officials from the Environmental Protection Agency (EPA). EPA Assistant Administrator for Water Jess Kramer stated that when drinking water and wastewater systems are affected, it can significantly disrupt everyday life.</p><p>Kramer noted a significant increase in attacks, citing various vulnerabilities such as failure to change passwords and the availability of system specifics online. She emphasized that the water sector is a critical target due to its integral role in daily life.</p><p>Jeff Hall, EPA Assistant Administrator for Enforcement and Compliance Assurance, explained that many water utilities operate with outdated infrastructure and insufficient cybersecurity resources. He indicated that these vulnerabilities leave systems exposed to attacks, particularly as hackers have shifted their focus from ransomware to more disruptive tactics.</p><p>Hall described how attackers manipulate human-machine interfaces to alter critical settings, which can disrupt services and pose risks to public safety. The warning comes amid heightened awareness of cyber threats targeting U.S. water infrastructure.</p><p>In July, a coordinated cyberattack affected over 30 community water systems in Minnesota, disrupting remote monitoring and control technologies. Recently, two small water utilities in Colorado were breached, although officials confirmed that drinking water remained safe.</p><p>Successful cyber intrusions into water systems can interfere with services essential to daily life, including hospitals, schools, and emergency services, raising concerns among national security officials about the vulnerability of critical infrastructure.</p><p>Kramer mentioned that workforce shortages complicate the challenge of defending against cyber threats, as many utilities struggle to recruit and retain skilled employees. The EPA has identified over 900 cybersecurity vulnerabilities in water systems since 2025, with common issues including inadequate password management and lack of multi-factor authentication.</p><p>Hall highlighted the need for better protections for programmable logic controllers and other industrial control systems that manage critical equipment in water facilities. He expressed concern about various adversaries, including state-affiliated actors and insider threats.</p><p>Despite the increasing threat, both officials noted that utilities are making progress in addressing common vulnerabilities. Kramer acknowledged the difficulty in measuring national progress due to the lack of authority to mandate reporting of cyber incidents. However, she indicated that there is evidence of improvement as utilities enhance their defenses.</p><p>Hall stated that EPA inspectors review cybersecurity planning at larger drinking water systems, and the agency's Office of Water provides technical assistance and training to help utilities identify and remediate vulnerabilities.</p><p>While there has been progress, Hall cautioned that cyber attackers are becoming more sophisticated, and many vulnerabilities still need to be addressed.</p>