On March 14, ransomware knocked out the water treatment plant serving 80,000 people in Minot, North Dakota. Staff spent 16 hours operating the system by hand. The city took more than two weeks to rebuild. Water quality was not affected, but the Supervisory Control and Data Acquisition (SCADA) system was gone, and the FBI was called in. The attackers have not been publicly identified. It shouldn’t have been hard to see coming.
When EPA inspectors began showing up at drinking water facilities across the country in 2023, more than 70 percent of the systems they inspected were violating federal law. Not obscure regulatory technicalities. Basic security. Facilities that had never changed the factory-default passwords on their equipment. Systems where every employee, past and present, logged in with the same credentials. Former workers who still had full access to infrastructure serving tens of thousands of people.
On April 7, the EPA, FBI, CISA, and NSA issued a joint advisory on Iranian-affiliated actors targeting water and wastewater systems. The advisory did not describe a potential threat. It described an active one:
U.S. organizations are experiencing exploitation and, in some cases, disruption of commonly used operational technology at drinking water and wastewater systems that are diligently working to ensure that Americans can rely on clean and safe water.
Reported consequences have included wiped system configurations, tampered mechanical sensors, and knocked-out control interfaces, along with direct financial losses. In November 2023, an Iran-affiliated group breached a Pennsylvania water system and forced workers to manually shut down a pumping station. The April advisory was the federal government’s acknowledgment that the threat never stopped.