When the water system hack was first reported last week in Minnesota, state authorities blamed Iran but Trump was quick to shift the blame to Tim Walz and his allegedly poor state government. Since then, similar hacks were reported in several other states, including Georgia. As this article points out, water systems traditionally haven't invested that much in cybersecurity for financial reasons, but that's now changing.As federal investigators sound the alarm about a string of recent cyberattacks that have hit water utilities across the country, a pair of Georgia water systems have revealed they were among the targets hackers infiltrated last week. Clayton County Water Authority officials said Monday a service disruption that temporarily knocked out water to parts of the county last week is under investigation as a possible cyberattack. On Tuesday, Columbus Water Works said that it too suffered a breach, though the utility said its service was unaffected. Both systems have stressed that their water supplies are safe.
State and federal law enforcement officials and local water authorities have been tight-lipped about exactly how hackers gained access to the Georgia water systems. But federal authorities have warned about an increase in attacks on a type of minicomputer commonly used by water utilities and other organizations. Experts say the devices, known as programmable logic controllers (PLCs), are found in a range of facilities across the country, from water treatment plants to hospitals, according to Saman Zonouz, an associate professor of cybersecurity and privacy at Georgia Tech. He says PLCs are more rugged versions of the simple controllers in home thermostats that tell air conditioning systems when to kick on. In a water treatment plant, they can be programmed to handle a single function, like opening or closing valves when water levels reach a certain threshold, or dispensing precise amounts of chlorine in the treatment process. There are thousands of PLCs controlling critical infrastructure across the country. Like other computers, they can be susceptible to hacking if they aren’t properly protected. “If that gets hacked into, then that’s the brain of the system and the attacker has control over your system,” Zonouz said.
Erin Thomas, a spokeswoman for the CCWA, said she could not confirm whether PLCs were used to disrupt the county’s water service because the agency is “still awaiting report findings on what caused the system outage.” Columbus Water Works did not immediately respond to questions about how the cybercriminals broke into their systems. The CCWA provides water, sewer and stormwater services to more than 250,000 people. Columbus Water Works serves a population of more than 260,000 people around the Columbus area.
On July 30, the federal Cybersecurity and Infrastructure Security Agency published an alert that it had observed a “significant increase in cyber threat actors targeting programmable logic controllers,” specifically in the water and wastewater sectors. The notice urged operators to “remove publicly exposed PLCs … from the Internet as soon as possible.” “Threat actors targeting exposed PLCs have modified passwords to lock out operators and disconnected the PLCs by changing their IP (Internet protocol) addresses,” CISA’s July 30 notice reads. Indeed, PLCs that are connected to the internet are most vulnerable to tampering, Zonouz said. And there are lots of them out there.
In an exercise reported in a 2024 paper, Zonouz and his colleagues used an automated scanner to scour the web for PLCs that could potentially be accessed by the public. They found thousands of the devices around the world that could be exploited. The devices, the researchers found, were engaged in controlling everything from water treatment facilities to power grids to manufacturing plants. But Zonouz said water and wastewater plants are often especially vulnerable because of a relative lack of investment in their cyber defenses. “It is actually more vulnerable and it’s a perfect target,” he said.
Law enforcement has also said little about the attackers’ identities, but a bulletin disseminated by the Georgia Association for Water Professionals, an industry trade group, indicated the operatives were affiliated with Iran. Experts with the bipartisan Center for International and Strategic Studies have said cyberattacks from Iran and its allies have been on the rise since the U.S. and Israel launched the war on Iran in late February.
In the meantime, Zonouz said he’s hopeful the attacks will be a wake-up call. “Moving forward, I think regulations will kick in to make sure that operators follow simple security hygienes and not just do everything for convenience reasons,” he said.
And, by the way, for those interested, news outlets in Georgia have been all over the case of Republican Senate candidate Mike Collins and his racist son-in-law who lives on his property. Last week, at a Collins campaign event, he cut the press conference short and walked out when reporters asked questions about his relation to his son-in-law.
