Korva is a scroll of the internet’s best ideas.
Over 100 US water utilities hacked
Iran's warning
In May, the Cybersecurity and Infrastructure Security Agency warned that Iranian hackers, retaliating for the war the US began, were targeting American critical infrastructure, especially industrial control systems: the technology that links digital computers to physical equipment in power grids, manufacturing, and water utilities.
The attacks spread
In August, attacks began on a handful of water utilities in Minnesota, then spread to 11 other states. The New York Times was first to report that officials suspected Iranian hackers. Wired obtained a water industry memo linking the attacks to the agency's earlier warning, tying this unprecedented wave to Iran.
How bad it got
The Center for Strategic and International Studies analyzed the attacks and found that only one utility, in Georgia, was affected to a medium degree: it lost water pressure and had to tell its customers to boil their water because of a contamination risk. Most of the others lost the ability to send commands to their equipment, were shut out for a time, and recovered with no real risk to people.
Why are water utilities easy hacking targets?
The United States has about 50,000 community water systems, and most are small, with limited budgets and often no dedicated security staff. Many run older control equipment that was never designed to face the internet. The US Environmental Protection Agency reported in 2024 that 70 percent of the water systems it had inspected since September 2023 failed to meet basic cybersecurity standards.
How do hackers reach water equipment from the internet?
The equipment is run by small industrial computers called controllers, which open valves and run pumps. If a controller is reachable online and still has its factory password, an outsider can log in and give it commands. In November 2023, the US Cybersecurity and Infrastructure Security Agency and partner agencies warned that Iranian government-affiliated hackers had compromised controllers at several US water facilities, often through default passwords.
Why does losing pressure trigger boil-water notices?
When pressure in a pipe drops, water can be drawn in through cracks and leaks, carrying soil and bacteria with it. Utilities issue boil-water notices because they cannot confirm the water stayed clean while the pressure was low. The Ten States Standards, a design guide used by many US state regulators, call for a minimum of 20 pounds per square inch throughout the distribution system.
More from Fresh Air
