Federal Investigation into Multiple Cyberattacks on U.S. Water Utilities

Federal authorities in the United States are currently investigating a series of cyberattacks targeting water and wastewater treatment facilities across the country. This follows a recent incident in Pennsylvania, which has been linked to an Iran-affiliated group.

A water district in North Texas, serving over 2 million people in areas including Plano and McKinney, is one of the suspected targets of these cyberattacks. In response, the district has engaged third-party forensic experts to assess the impact of the intrusion on their operations and to determine if there has been any compromise of district data.

The FBI announced its investigation into these attacks one day after the Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory regarding threat groups exploiting vulnerabilities in Unitronics programmable logic controllers at water treatment facilities.

The Municipal Water Authority of Aliquippa in western Pennsylvania was reportedly attacked on Saturday by a group calling themselves Cyber Av3ngers. This group claimed responsibility for the attack, which is believed to be linked to the usage of Israeli-made equipment at the facility. In response, Pennsylvania Senators Bob Casey and John Fetterman, along with Representative Chris Deluzio, have written to Attorney General Merrick Garland requesting a Department of Justice investigation into the attack.

Cybersecurity researchers at Check Point have previously indicated that the Cyber Av3ngers group has been involved in attacks on critical infrastructure in Israel since the onset of the most recent Israel-Hamas conflict in early October.

Marty Edwards, Deputy CTO for OT/IoT at Tenable, emphasized the need for improved industrial security and suggested that government regulation may be necessary to ensure the cybersecurity of public services like water and wastewater systems. The recent attacks underscore the growing concern over the security of critical infrastructure and the need for enhanced protective measures against cyber threats.