(David Paul Morris/Bloomberg via Getty Images)
A cyberattack that hit a water treatment facility in Kansas over the weekend appears to involve ransomware hackers.
On Sunday, the water treatment facility in Arkansas City, Kansas, encountered a “cybersecurity issue” that was serious enough to cause the plant to switch to manual operations.
The city hasn’t provided more details. However, the Water Information Sharing and Analysis Center (WaterISAC), which is dedicated to sharing security threat intel to US water facilities, is indicating a ransomware group is behind the attack.
“Arkansas City has notified relevant authorities and is collaborating with cybersecurity experts to manage the incident, which is believed to be a ransomware attack,” the center said in an alert on Tuesday.
A local news report from KWCH.com adds that an apparent ransom note appeared on a water treatment facility computer, demanding the employee contact the attackers via email. This suggests the ransomware gang successfully encrypted at least some computer systems and likely stole information from the water facility.
Whether the city will pay the ransom is unclear. The good news is that the water remains safe to consume, according to Arkansas City officials, who report no disruption to the local water services. Still, the attack underscores the threat of ransomware groups and state-sponsored hackers targeting US critical infrastructure, which could force them offline or cause other disruptions. Two days before the attack on Arkansas City, WaterISAC issued a members-only alert, warning that “Russian-linked threat actors” had been targeting water facilities.
In the meantime, Arkansas CIty has told the public: “Cybersecurity experts and government authorities are working to resolve the situation and return the facility to normal operations. Enhanced security measures are currently in place to protect the water supply, and no changes to water quality or service are expected for residents.”