(Credit: Pablo Lagarto/Shutterstock)
The country's water systems are being hit with an increasing number of nation-state cyberattacks, according to the US Environmental Protection Agency (EPA), which is urging US states to dramatically up their IT security measures to guard against future infrastructure attacks.
EPA Administrator Michael Regan and Jake Sullivan, Assistant to the President for National Security Affairs, wrote a letter this week detailing China- and Iran-backed cyberattacks against US water systems.
"Disabling cyberattacks are striking water and wastewater systems throughout the United States," Regan and Sullivan write. "These attacks have the potential to disrupt the critical lifeline of clean and safe drinking water, as well as impose significant costs on affected communities."
The duo allege that malicious actors connected to Iran's Islamic Revolutionary Guard Corps have attacked US water systems, in one case succeeding because the water facility didn't change the default manufacturer password.
The Chinese Communist government-backed cyber group Volt Typhoon has also infiltrated multiple "critical infrastructure systems," including those that handle tap water, the letter says.
"Volt Typhoon actors are pre-positioning themselves to disrupt critical infrastructure operations in the event of geopolitical tensions and/or military conflicts," Regan and Sullivan write.
The EPA and US National Security Council (NSC) will host a meeting Thursday to discuss the issue, potential solutions, and urge state governments to take proactive action, according to a statement. The EPA is also creating a Water Sector Cybersecurity Task Force.
The US Cybersecurity and Infrastructure Security Agency (CISA) previously noted in November that some US water systems have been attacked. CISA advised water management facilities to change their default passwords, require multifactor authentication (MFA), and disconnect their programmable logic controllers (PLCs) from the internet or add a firewall or VPN to better secure their systems, to name a few of its suggestions.