More than 100 water systems were hit in July cyberattacks

The US government disclosed that crims targeted more than 100 internet-exposed water systems during July cyberattacks. That's the first time the feds have put a number on the digital intrusions, but they have yet to attribute the campaign, widely suspected to be linked to Iran, to a particular group. “In July 2026, CISA observed …

[Paul Crawford]

“More than 100 water systems with internet-exposed assets were hit in a single month"

How many without internet-exposed assets were hit?

[Mr. Flibble]

huh? i guess not so many as they weren't on the internet?!?

[Jou (Mxyzptlk)]

They will come. The order is: Easiest target, easy target, medium target, difficult target. Stuxnet managed to bridge air-gap, so it is not a matter of "possible or not", it is a matter of cost and effect.

[MachDiamond]

"Stuxnet managed to bridge air-gap, so it is not a matter of "possible or not", it is a matter of cost and effect."

There's a bit of nuance and social engineering for that one all funded by a State agency.

If there is little risk to the attacker, the value of the target can be less. If a water system was air-gapped and the attacker had to visit the premises to carry out the attack, that would be risky as hell. To be able to do it from a chair on the beach, not so much.

With loads of low hanging fruit, a large scale attack may not need to worry about what's at the top of the tree as the breadth of any damage would make those targets unneeded.

[Jou (Mxyzptlk)]

> funded by a State agency

The water systems here were allegedly attacked by a country agency. The probability that is was Iran is quite high, but the proof is still lacking. So it could have been a 12 year old from somewhere inside USA, born there, raised there, 100% proud to be American, who just didn't know that he played a real global thermonuclear war instead of tic-tac-toe.

> the attacker had to visit the premises to carry out the attack

For Sutxnet the attacker did NOT visit the premises, didn't even come near it. And the target was air gapped. It took a while until the payload arrived, but it worked.

[Disgusted of Cheltenham]

Not very original - the attack on the Maroochy Shire system in Queensland was a generation back: in 2000. That was a disgruntled job applicant pretending to be pump 14.

Before the internet, it was claimed that British houses had (and many still have) cold water tanks because Napoleon might do something nasty to the water.

[Roland6]

Didn’t know about the Napoleon angle, but a 200 ltr loft cold water tank does mean you can continue to flush the loo for a few days whilst the water supply is out (a couple of weeks back we experienced our supply became unreliable due to the continued heat wave: soil shrinkage causing (Victorian) pipes to move and break and more modern pumping equipment to fail.

[RockBurner]

Lovely things to have....

Until the rats start falling into them and drowning.

(grew up in a house with a large cold-water tank).

[Paul Crawford]

I think you will find the cold water tanks are headers for the hot water, as well as the cold supply to any gravity-fed showers using both (so they need equal water pressure). Hot water was slowly heated by a back boiler off a coal fire and so was stored in a tank. Cold taps are off the mains supply to avoid the contamination / bacteria risk off stored water.

These days hot water is usually a real-time gas heating boiler so you get hot & cold at mains pressure, and no storage tank for the hot water. But going back to tanks I think as heat-pump systems can't practically deliver the kW that a combi boiler could for real-time heating.

[Roland6]

>” These days hot water is usually a real-time gas heating boiler so you get hot & cold at mains pressure, and no storage tank for the hot water.”

Yes the major builders like the mains pressure boilers as they remove the need for header and hot water tanks and associated plumbing, making house building cheaper and faster for them. As a user, these boilers/heaters are more costly to repair etc. and mean when the water company goes off-line so does your entire water supply…

I suspect this is one of those things, where because the system works most of the time, many haven’t experience the panic of waking up, flush the loo (working the once, due to having a full cistern) then discovering you can’t fill the kettle and there is no water for that “get ready for the office/being among people” shower…and to cap it off you realise the toilets won’t flush and the rest of the family are getting up…

[Paul Crawford]

Most places I have seen have the cistern fed from the mains along with the cold taps, etc. But having tank-fed hot water that you could boil in a kettle to remove bacteria, or fill a jug for sort-of-flush, is an option if folks realised at the time.

[Mister Dubious]

Unprovoked, I say!

“Iran-affiliated actors and adversaries are actively targeting [...] essential health, safety, and critical infrastructure across society.” Inflicting harm on civilians and other non-military targets is a war crime, right? Oh, those nasty Iranians! We should punish them by bombing still more of their power plants, dams, bridges, and water purification systems. That'll teach 'em not to attack a peaceful nation!

[alain williams]

Re: Unprovoked, I say!

It has got to be the Iranians as they are the USA's current enemy. I would want to see solid proof before believing who it was.

[Anonymous Coward]

Re: Unprovoked, I say!

It's more likely all those experts who used to provide oversight that were released by DOGE who know how to target the systems and want revenge.

[hoola]

Re: Unprovoked, I say!

I would have thought there is a reasonable list of countries or people who are not averse to causing the US/Trump some pain or inconvenience at the moment.

Iran maybe near the top but as with all these thing making an assumption that it is one country usually ends badly.

[Jou (Mxyzptlk)]

Re: Unprovoked, I say!

The real enemy of the USA is currently in power. A part of the people still haven't noticed yet (whatever they have not noticed yet, since some think Bush, senior, is still in power)...

[Snake]

Re: real enemy

This. The problem is that the [young] people who could vote, and make a difference, don't bother to, leaving the [old] people to make decisions...that benefit only people like themselves.

[cmdrklarg]

Re: real enemy

Well, the orange god emperor is not exactly doing things to benefit old people; he's working only to benefit himself (the wealthy benefit because his actions help them too).

Those normally GOP voters who aren't MAGA cultists are starting to realize just how bad things are going for themselves. The young are also becoming aware about just how hard the orange guy is screwing them over. It's looking to get real ugly for the GOP come November; it's no wonder they are trying to subvert elections again.

[Jou (Mxyzptlk)]

As always: Life less value than money.

Still don't believe me? Latest US Chemical Safety Board video. Just a day old. As usual "regulations which are not enforceable", "no control" and "the USCSB recommends". Sadly always only recommends.

These results of "Money is the only god", as displayed in a well known movie (note that I don't call it fiction any more)...

[Anonymous Coward]

Re: As always: Life less value than money.

The Midas touch at work, everything he touches is covered in gold and BS.

[DS999]

If CISA wants to be useful

It should spend its time hacking into US water systems, power plants and other infrastructure. When it is successful they should contact the responsible local government and require them to formulate a plan to address the shortcomings, and work out a cost sharing agreement if it is a small town water system rather than say Minneapolis or Dallas'. If it is a commercial entity like a power plant then they should notify them of the hack and start the clock ticking for that to be fixed and if it isn't they are subject to having shares confiscated and sold to fund the upgrade (so that it is the owners who are forced to pay for it, not the customers)

[BBRush]

Re: If CISA wants to be useful

Honestly? I suspect they would really quite enjoy doing something that rewarding and useful. Sadly, DoGE/Trump gutted them at the start of the second term and I don't think they have the people or the budget to do that now.

Hell, it took them a while to find the money for MiTRE.

[Uh, Mike]

"We Should Be Covered"

We had Frank look into this security thing. The only outside connection he knows of is the one Randy uses in case something needs fixing while he's on vacation. And we know he has a really good password, not the one all the other computerized equipment came with.

[Anonymous Coward]

Re: "We Should Be Covered"

You've assumed that there isn't a hardcoded username and password in the device, or any type of authentication bypass vulnerability.

[Jou (Mxyzptlk)]

Re: "We Should Be Covered"

Who's Randy?

Oh that's the Nephew from Charlie, a good friend of Mike, who recommended Abe for the Job.

And they needed the codes too.

[deadlockvictim]

Nuclear Power Plants

What first came to mind when I saw the headline was the possibility of any nuclear power plants being affected by upsetting these water & wastewater systems?

Greatly reduce the amount of cooling water, or, as in Fukushima, flood the plant with water and bad things can happen.

Then I thought about flooding, drought and possible contamination of ground water with insufficiently-treated wastewater.

This all looks the first warning signs of impending disaster that will make global news.

The miscreants are learning about such systems and getting their practice in now and learning about the various governments at each level respond.

Who knows if they have an especially vulnerable target in mind.

[Anonymous Coward]

Re: Nuclear Power Plants

Or just let idiots manage your waste management infrastructure, like they do in Maryland.

[Anonymous Coward]

Re: Nuclear Power Plants

'Then I thought about flooding, drought and possible contamination of ground water with insufficiently-treated wastewater.'

Look no further than Thames Water.

[Anonymous Coward]

IOT -- or IDIOT

I have a large customer who decided that their operating plant systems needed to be accessible from their divisional office about 200 miles away, and to their head office (which is in another country about 1,000 miles away. It transpired that it was possible to access the plant control systems from remote locations via a dial in system.

As part of a cyber security audit carried out in 2015 as part of the UK Control of Major Accident Hazard Regulations this was flagged up as a potential major vulnerability. Following this, remote access was removed from the system although plant performance data was still available at the remote locations.

There was no possible reason to provide remote access for control as the site is manned 24 / 7 / 365 but the directors had wanted the facility 'just in case' although the case was never defined. As part of the process, all PLCs and control systems were hard wired and wifi to these items was removed. It took over a year to do this and a significant amount of money.

My opinion is that many operators use internet enabled devices e.g. PLCs to make it easier for them to de-man plants and do everything from a central control centre -- because it's cheaper.

[Roland6]

Re: IOT -- or IDIOT

>” My opinion is that many operators use internet enabled devices e.g. PLCs to make it easier for them to de-man plants and do everything from a central control centre --”

But cloud provisioning and management has been a thing for years in the networking sector. However, in this instance it hasn’t so much been because it is cheaper but because it’s so much easier.

[Jellied Eel]

Re: IOT -- or IDIOT

But cloud provisioning and management has been a thing for years in the networking sector. However, in this instance it hasn’t so much been because it is cheaper but because it’s so much easier.

Until things go wrong. Ohnoes! We've lost connection to the 'cloud'. Ohnoes! Our 'cloud' provider is down! Ohnoes! We're dead in the water and a vulture from El Reg is on the phone!

Oops.

I have actually used the last example when talking about how to do CNI stuff properly with manglement. Do you want to become an El Reg headline? Do you want your customers or shareholders reading about your oopsie on El Reg? No? But that's just one of those things that world weary network engineers have to deal with. Big, Blue-Chip business runs SAP, and relies on SAP to manage production lines, warehouses, and the one that can focus manglement's minds the most.. paying expense claims.

Then insisting that a proper network design is too expensive, and everything should just be connected with xDSL. And sometimes they wave quotes from another supplier that's proposed 2x xDSL connections because that's somehow going to be diverse or resilient. Ah, fun times!

But a lot of bad decisions do come down to cost, or a perception that it's easier.. At least until they've become isolated from their network. Which is just one of the reasons why I hate cloudybollocks. You're outsourcing your P&L and reputation to a business that doesn't care about you, your customers, or your reputation. Especially when 'cloud' vendors can make it very difficult to use anything other than the Internet for connectivity. It might be dressed up in a VPN, but you're still going to end up with public interfaces that can be attacked.

[StewartWhite]

The Smartest Guys in the Room

Connecting PLCs directly to the internet “can create significant security risks.” - see icon.

[retiredFool]

How could this be a surprise to anyone?

Still have my site up. I get maybe 1% real traffic, 9% bots, 20% probing for open ports, 70% looking for any php, json, ... exploits on the web server. Continuously. Like packets every second. And that is with blocking about 1/4 of the internet at the firewall level staticly. And of course dynamic blocking for various patterns. Thankfully some statics are easy where you can whack a block with a /8.

I can't imagine what additional effort would happen if someone found a IP address to be "interesting" and be something like a water system behind it instead of a boring static website.

[VoiceOfTruth]

Stop bombing Iran

Then I might have one ounce of sympathy.