Wave of Water System Cyberattacks

Coordinated attacks on water utilities across at least 12 states (now including Michigan and Georgia), targeting Rockwell PLCs with default passwords and direct internet exposure. New incidents in New Jersey and Rapid City, SD (quickly detected). FBI/EPA advisory details TTPs; Iran under investigation. Georgia Tech research reveals 96% of exposed PLCs have critical vulnerabilities, with prior estimates undercounted by 37x. State funding models emerging (NY SECURE grants, Guilderland checklist). FBI issued proactive advisory to Arkansas utilities reinforcing basic hygiene. West Virginia officials held a meeting on the threat, noting 4,209 unreported attacks in the state. Cortland County, NY received a SECURE grant for water cybersecurity upgrades. A new Senate bill (RMUC reauthorization) would provide $250M over 5 years for rural electric and municipal utilities.