A water tower is seen on July 30 in Plymouth, Minn. A cyberattack targeted the operating technology at over 30 water systems in Minnesota, including Plymouth's late last month, state officials said.<\/p>\n
Ellen Schmidt\/AP<\/p>\n
hide caption<\/p>\n
On a recent Monday morning in Braham, Minn., a local water operator made an unsettling discovery \u2014 the pump at the treatment plant wasn't working, threatening the flow of water to people's homes.<\/p>\n
While investigating the root cause, crews took the plant offline, and the city urged Braham's 1,700 or so residents to conserve water while they drew on a backup supply stored in a local tank.<\/p>\n
It only took a couple of hours for workers to restore the flow after taking manual control of the pump. The self-proclaimed homemade pie capital of Minnesota still hosted its annual Pie Day celebration at the Park Cafe just days later.<\/p>\n
But what Braham officials quickly learned, after connecting with Minnesota state IT teams, was that they were not alone in the outages. The cause was a "coordinated cyberattack" against industrial technology nationwide, and cybersecurity experts and federal officials suspected Iran may be to blame.<\/p>\n
It's nothing new. Adversaries, including Iran, have been targeting U.S. critical infrastructure for years, to steal data or cause disruptions. Once inside, they can ransom the data to make money or threaten access to and trust in critical resources, from water and power to transportation and their bank accounts. "Everything's connected to the internet in one way or another," Nate George, the mayor of Braham, told NPR in an interview. "It's not Braham in particular that's being targeted. It's the internet access points and the vulnerable technology," George, a U.S. Air Force reservist, continued.<\/p>\n
While the hackers failed to compromise the water supply, they succeeded in inspiring headlines and provoking uncertainty. And the scope, scale and real-world impacts of the attacks, like the one in Braham, have been remarkable even to the experts.<\/p>\n
"I can't recall a time when there's been this many targets at once with operational impact," said Rob Lee, the co-founder and CEO of Dragos, a cybersecurity firm focused on industrial technology. Lee told NPR he's aware of victims of this recent spate of attacks outside the water sector, as critical infrastructure operators tend to rely on the same technology. It's something Lee has been warning about for years. "This is pretty significant," Lee said.<\/p>\n
Local and federal officials are looking to get their arms around what happened, help critical infrastructure operators secure their systems, reassure the public and prepare for the future for the more than 150,000 water and wastewater treatment systems in the U.S. \u2014 because the next wave of attacks could be worse.<\/p>\n
"It appears this is a shot across the bow from Iran," Jake Braun, the former White House acting principal deputy national cyber director during the Biden administration, told NPR.<\/p>\n
Between July 26 and July 28, several local authorities in Minnesota let citizens know about problems at community water plants from Braham to Maple Plain, Minn., where officials declared a brief state of emergency before determining that "the immediate threat to public health, safety and welfare had been addressed."<\/p>\n
Cities and towns across the country began to join their ranks. In Clayton County outside Atlanta, local officials issued a brief "boil water" advisory after a pump station failure was detected in the middle of the night. There were other outages in New Jersey and Michigan.<\/p>\n
A cybersecurity information-sharing organization for the water sector, WaterISAC, was quick to convene a call for its 400 or so members across community water systems to disseminate intelligence from the federal government about the attacks. The EPA followed up with a publicly available webinar "to discuss an urgent operational matter dealing with cyber threats to the water sector."<\/p>\n
The FBI then confirmed that at least seven states suffered similar attacks on water and wastewater facilities. Their investigation is ongoing.<\/p>\n
The scope and scale could be much larger. Beyond Lee of Dragos mentioning victims outside the water sector, one state IT official who requested anonymity because they weren't authorized to comment on ongoing investigations, said there's still concern about the transportation and energy sectors being impacted by these attacks.<\/p>\n