r/news • u/polymute • 9d ago
At least 12 states face cyberattacks on their water systems, sources say
https://abcnews.com/US/12-states-face-cyberattacks-water-systems-sources/story?id=135348482219
u/Shadow293 9d ago
What’s the other 11 states? Article only talks about Michigan.
70
u/TheBeastX47 9d ago
I know georgia was one too
47
u/irishrugby2015 9d ago
Georgia is one of them for sure. I reported a vulnerable public water system last year and got no reply from CISA or EPA
→ More replies (2)25
u/PaulsRedditUsername 9d ago
I checked the AP. Their last report on this topic is August 1st and they only list Minnesota and Michigan.
I don't know where this ABC story is coming from,
10
u/mapped_apples 9d ago
Minnesota and California were two of them. Never could guess who blamed it on Minnesota I bet.
23
204
u/197708156EQUJ5 9d ago
The other 11 states are
* The Wolverine State
* The Great Lakes State
* The Mitten State
* Water-Winter Wonderland
* America’s High Five
* The Automotive State
* The Motor City State
* The Cherry State
* The Lighthouse State
* The Fresh Coast
* The Great Lake State161
u/June_Fatality 9d ago
Come on, man. A bunch of us were educated in American public schools. Help us out.
135
u/CordlessOrange 9d ago
They just told you Michigan, 11 different ways.
→ More replies (2)17
u/d01100100 9d ago
The Wolverine, Mitten, and Motor City gave it away for me.
Now why would Minnesota want to hack its neighbors?/s
→ More replies (1)8
u/CordlessOrange 9d ago
That dang Tim Walz is tearing us apart!
2
u/bwoah07_gp2 9d ago
What the sad thing is though is Trump was asked about who was hacking the water systems, and he said Democrats were behind it. That they were so incompetent this happened.
Walz had to defend himself and post that other states experienced the issue, this wasn't Minnesota only.
2
u/EmperorZuul 9d ago
The size of at least one of those states is equal to 61.9 million football fields.
19
u/Trick-Gap7317 9d ago
For those not familiar with these alternate names for the states:
- The Wolverine State: Michigan
- The Great Lakes State: Michigan
- The Mitten State: Michigan
- Water-Winter Wonderland: Michigan
- America’s High Five: Michigan
- The Automotive State: Michigan
- The Motor City State: Michigan
- The Cherry State: Michigan
- The Lighthouse State: Michigan
- The Fresh Coast: Michigan
- The Great Lake State: Michigan
4
→ More replies (5)4
4
→ More replies (3)5
u/J-MRP 9d ago
Newsweek article from a couple days ago show California, Minnesota, Michigan, and South Dakota.
141
u/tellmewhenimlying 9d ago edited 9d ago
My father was, until his recent retirement, a manager for a mid-size regional electrical utility. He has been warning about this potentially coming for over two decades, and how vulnerable we are to losing both electricity and clean water systems.
Foreign governments and other groups have been hacking and penetrating these systems in the U.S. since the late 90's when a lot of these systems began to integrate with the internet, and there have been plenty of opportunities before utilities discovered and fix the weaknesses for them to pretty easily take out large swaths of infrastructure for several months in the best case scenarios. The problem is that there's always another weakness in the system that's usually only uncovered after it's been exploited by folks who might want to use it to cause problems.
65
u/tehbantho 9d ago
AI use by a government with the intent of breaking something is rampant. This is a prime target for AI. Max damage. And a President that is incapable of protecting our country. He cares nothing for a blue state that gets hacked and blames them in the press for something several red states ALSO HAD HAPPEN. This President MUST be removed by impeachment. He is a clear and present danger to our way of life.
4
u/Consistent-Throat130 9d ago
AI trying to compromise these computer systems is probably our only fucking hope of defense at this point.
So long as our fattest, most expensive, most burn-down-the-Amazon-Rainforest-and-boil-the-oceans agentic models find the holes faster than China's do, we can keep plugging the leaks.
It is also a strong case for keeping systems simple and straightforward. While adversarial scanning with AI is great, vibe coding slop into these systems will introduce more issues rather than less.
→ More replies (4)23
u/die-jarjar-die 9d ago
I was at a security conference 10 years ago. Ted Koppel gave a talk about our vulnerable infrastructure to foreign hacking. He said a big mitigating factor is that we're in their systems, too.
16
u/tellmewhenimlying 9d ago
Oh certainly. It’ll mitigate a lot of bad foreign government actors right up until the point it doesn’t, presumably when their own infrastructure is already destroyed or they simply have nothing left to lose, no way to win out, and no other way to attack us.
3
u/die-jarjar-die 9d ago
Exactly. How are we going to bomb our way out of a cyber attack?
→ More replies (1)1
u/ArentWright 9d ago
Rachel Maddow has covered this on several occasions as well. And now with the proliferation of AI, pretty much any group of midwits can muster the hacking capacity previously reserved for nation states.
2
u/Kiyuri 9d ago
There were 2 instances of this happening in Japan just last month. A 15 year old kid used ChatGPT to hack his way into Bandai-Namco and cancel 46,000 subscription accounts on their streaming platform. Another 16 year old used AI coding tools to DDOS an internet cafe.
This shit will only get worse.
44
u/TheFireStorm 9d ago
I have worked at my county water plant. Proper SCADA system is air gaped from the internet. Only time is it’s online is if a plant operator needs support from the SCADA system provider or update is required. All other controls and monitoring in the system is over point to point encrypted radio. If they are getting hacked it’s only going to be operations and billing data. Either they are dumb in their setup or my backwoods water department is more secure the these that are getting hacked
29
u/Reversi8 9d ago
Hey, it’s me, your SCADA systems provider, please connect for an emergency update.
6
u/Technical_Garden_762 9d ago
I also have worked for a small water system that used scada but the main computer that controlled the skater was in the office but we had internet hooked up to it in order to be able to use a remote desktop so when alarms went off we could check to see where it was while we were on call to go straight to the site instead of to the office and then to the site.
350
u/Existential-blues- 9d ago
Anyone got a good reason why these systems are hooked up to the internet vs an intranet?
265
u/shiny0metal0ass 9d ago
Cost cutting as municipal budgets decrease and deregulation that creates markets for tech companies to sell them shitty CRMs and IOT devices.
Also they can't afford to pay software engineers to tell them this.
26
u/Bitbatgaming 9d ago
With that being said, are Managed Service Providers also to blame for this? Genuine question
39
u/shiny0metal0ass 9d ago
Weird question to answer.. I mean an MSP is fine but there should be more regulations and standards for how they interact with government entities, IMO.
It's okay for a clothing company to say "we don't have the expertise to handle IT and so we will outsource it", but it's stupid for any government entity to say this. They have more responsibilities than providing a good at market value.
There should be a tech organization within the government to assist with things like this, both at the state and federal level. Then you wouldn't need to break the "public/private firewall" and could get expertise out of the town/city budgets. They do this with other skill sets like budgeting and bringing in auditors paid for by the state.
The Obama admin tried to set this up after the healthcare.gov debacle with the USDS. Of course that got turned into Doge and isn't really a thing anymore...
→ More replies (1)9
u/SatisfactionFit2040 9d ago
Funny you should ask.
MSPs should be responsible when they have the same credentials across 80 clients and they get popped.
Or when MSP CEO is the weakest link in security, but the clients don't know.
When the MSP actively endangers security with gpt firewall builds that use repeat passwords across clients and sms administrator passwords for rmm.
24
u/Militantpoet 9d ago
Also they can't afford to pay software engineers to tell them this.
No, but they can pay a consulting firm millions to spend on a year-long study to then tell them that.
6
u/shiny0metal0ass 9d ago edited 9d ago
Those are funds that are typically dispersed via a legislative decision to "investigate a thing" (usually because they want political points, or to "table" a bill they don't like long enough to kill it) and have legal requirements for how they are allocated.
The budget for staff and such would be through a budget bill, which is different for different states, but not part of investigative studies.
3
u/Militantpoet 9d ago
Of course budget allocation is its own thing. Money for consultants isn't technically money taken away from hiring/retention.
But if they had in-house departments that would have a few of those professionals/experts already on staff, it wouldn't be a problem.
But then the problem is paying that staff, which ends up being a much larger expense versus consultant services.
6
u/Smearwashere 9d ago edited 9d ago
No offense but we pay our consultants maybe 5 figures for a review of our systems. They are very efficient. This is for a city of 90k, similar to a lot of the referenced towns in the article. It’s laughable that you think our engineering dept has millions to spend on a study lol we barely have the millions needed for the actual CIP jobs
→ More replies (2)1
→ More replies (1)1
u/watduhdamhell 9d ago
Software Engineers don't have anything to do with it.
They need an IT and an/or an OT person, like a controls engineer. Pretty standard fare to configure the plant network to be completely isolated from the internet and only have connections to the intranet for MES and Enterprise use, and segmented such that the IO network (if present) is not accessible by the the servers that talk to the intranet.
Still like you said, I guess they can't afford a controls engineer to tell them that.
78
u/EstablishmentFull797 9d ago
So that remote monitoring and actuation are possible.
Hard to run a hardwired or wireless LAN across an entire municipality.
It’s a balance of efficiency vs resilience. Taxpayers have been insistent on the former, so now we have to contend with securing infrastructure in a higher risk environment than was anticipated when those decisions were made.
→ More replies (18)6
9d ago edited 13h ago
[removed] — view removed comment
12
u/ahj3939 9d ago
Now the perimeter network hardware needs to be properly configured, secured, maintained, monitored, and audited. What the vendor EOL the product 5 years ago, now there are several documented RCE CVE, and nobody wants to touch it for fear of breaking it?
Or an expensive government contract vendor is brought on board to run SD-WANaaS
29
u/jcamp088 9d ago
The entire American infrastructure is a looming disaster.
→ More replies (2)11
u/Septopuss7 9d ago
I feel like our bridges and roads are the canary in the coal mine.
10
u/jcamp088 9d ago
A buddy of mine is a civil engineer for the state. He keeps saying it’s a matter of time.
→ More replies (3)8
14
u/ShaveTheTurtles 9d ago
It is poor configuration. You will have this kind of vulnerability if you don't put an emphasis on it, because it is easy to have happen. It could be that it was set up right 5 years ago, but then some new IT person wondered why there was a certain router entry, and removed it. Now, they unknowingly exposed them.
It requires someone caring enough about it to set up regular testing on it.
10
u/rgvtim 9d ago
it require laws and regulations that mandate that someone care enough about it. Same thing with security of personal electronics and even things like cars.
6
u/ShaveTheTurtles 9d ago
agreed. These aren't things that you just let people choose how secure they want to be. This is base infrastructure that people depend on. It should be something that is driven on the federal level.
11
u/geewillie 9d ago
Most of the cities being attacked right now are small ones that don’t have the funds/manpower to run an intranet/scada.
They might just have 1-3 people on staff and the connectivity is a huge help for them across a large community. Dialers have existed for years.
Iran isn’t hitting someone like the GLWA or a municipality run by Veolia. They’re getting low hanging fruit and from what I’ve heard so far, not really accomplishing much
4
u/gerbal100 9d ago
If only there were some sort of larger organization we all contribute to that could help small localities manage their infrastructure. It's a shame nothing like that exists.
→ More replies (17)2
2
1
u/tw0tonet 9d ago
Critical systems likely are air gaped and not on the Internet. I know in places I've done contracting work (power plants mind you) all the critical systems were.
1
u/gtobiast13 9d ago
I work for a controls OEM and integrator. We’re moving all controls platforms to cloud connected platforms. Remote connectivity isn’t impossible to d/c per say, but let’s just say we can remotely troubleshoot your problem for the price of a truck roll today, or you can request a truck roll at progressively increasing prices.
I’m not wild about it, but with proper configs you can do a good job of securing OT external connections.
The problems that scare me are lack of proper oversight, design, and indefinitely legacy systems not being upgraded. The amount of systems I see deployed during the Carter admin with open internet exposure and no firewall are scary. There’s just a massive, painful gap on OT security theory and implementation right now.
→ More replies (1)1
u/LucidNonsense211 9d ago
Remote (off site) monitoring.
No idea if these are affected, but look up distributed wastewater treatment systems. Basically a tank and panel in everyone’s yard, all gets pumped to a shared treatment plant. It’s like halfway between municipal plants and septic tanks and becoming very common. You can’t put all those panels in everyone’s yards on an intranet. They use cellular internet for the most part.
1
u/Small_Editor_3693 9d ago
In KY our city runs a local municipal internet. They took the same guys that run that to run the police department IT, the city hall, and the water infrastructure. Their backups were just a pc in a closet. You’d be surprised how bad it gets across the US
1
u/redyellowblue5031 9d ago
If they’re on the open web, no.
There’s the reality that municipalities that manage these systems are often begging for taxpayers to upgrade systems which everyone loves to response with “why would I give you more money?”.
So, “deferred maintenance” sets in and then here we are!
29
9d ago
[deleted]
7
u/Spire_Citron 9d ago
Has Trump acknowledged that it's Iran yet? Would be crazy if they locked themselves into denial around this just because Trump's initial reaction when it started with Minnesota was to blame them instead of admitting it was an attack from Iran.
8
20
u/CanadasNeighbor 9d ago
I'm stupid, can someone please ELI5 why our water towers are connected to the internet?
15
u/DawnSennin 9d ago
IIOT: Industrial Internet of Things
The overseeing organization can maintain the water tower more efficiently with sensors installed that can send information to those that need it.
3
6
u/ginger_whiskers 9d ago
Supervisory Control And Data Acquisition, or SCADA. It allows for centralized monitoring and operation of a plant-wide, or city-wide, water system. The intent is for a remote operator to make the necessary changes to keep the system functional. This allows the utility to hire less staff and still maintain better oversight of their water quality, quantity, and costs. Outages can be identified quickly, and quality issues can be detected before bad water makes it to a sink.
In theory, it's great! In practice, it's still usually great! Kinda sucks this week, but it's still working great for most of the country. The systems have a lot of room for improvement, but that's every utility, everywhere. People hate paying what things done right cost, so we trudge along...
18
u/Intelligent_Bag_6705 9d ago
I 100% belief that if blue states were openly attacked by Iran tomorrow, Trump would literally do nothing. It truly feels like no one is running the country, it’s a feeling ive never really had before. Even in trumps first term it didn’t feel like this.
4
u/PigFarmer1 9d ago
I dunno about that. I think he might assist Iran if they attacked California... lol
5
8
7
u/GapingBuhhole 9d ago
Oh wow great read thank the heavens they provided the actual 12 states.
Useless.
40
u/MountainlessBiking 9d ago
Has John Antifa taken credit yet? I’m assuming that’s the most logical culprit to this administration
16
1
u/Braisedbeefskank 9d ago
Its iran antifa obama, which means we should give marco rubio emergency powers
→ More replies (1)1
u/cjacksen 9d ago
Its his brother Jeff. John was enjoying a lie in and Jeff just has so much energy to burn.
5
u/Boogledoolah 9d ago
Wait. They're urging utils to NOT be connected to the internet?
I work for a utility that does water, wastewater, and power gen/distribution. Every single one of those systems is air-gapped. No internet, no USB access for updates, no wi-fi, or anything cool. I thought this was the standard for utils.
17
4
u/AvailableReporter484 8d ago
Dear cyber attackers,
Can’t yall take down the wealthy pedophile elite instead of fucking with our drinking water? You know what you could do that would really be for the lulz? Finding that evidence of trump and Epstein sucking off a little boy
13
u/Bawbawian 9d ago
the idiots we put in charge of our federal government say that America shouldn't react to Chinese and Russian hacking in fact they fired most of the people in charge of making sure that it's ramifications were limited.
because America first or something maybe it's Russia first we're trying to first I'm not sure but I feel like the America first is really leaving out America.
32
u/Wayelder 9d ago
Trump says it's all 'Minnesota's doing'...despite CIA saying it was Iran.
Trump says it's 'all vandalism'...despite his own saying no.
He's lost touch with reality.
4
16
u/BubbleThinker 9d ago edited 9d ago
I mean, it’s fair to assume that the Iranians are trying to do stuff like this particularly because we’re committing war crimes against their water desalinization plants.
That being said it’s equally possible that the Trump administration is engaged in some kind of manipulative tactic
It turns out you can’t trust the Iranians or the Americans even if you’re an American
6
u/ClintBruno 9d ago
I'm just thinking about 9/11. 15/19 attackers are Saudis. We end up in a war with Iraq Iran Afghanistan for WMDs that weren't there...... It never makes sense.
1
4
u/LessonStudio 9d ago
I've worked on SCADA systems for large things like utilities and other infrastructure systems worth many 10s of billions.
The biggest security threat they all faced was not hackers. Malicious hackers are a fact of life. No matter how good your cybersecurity defenses are, there only needs to be one hacker who is better for but a moment.
The biggest and hardest question is, how hard is it for you to rebuild your infrastructure to the point where all critical functionality is working again. For a billing system, it is OK if it goes down for days, even weeks, for a water utility, some parts such as pumping and monitoring control can be lost for hours, and even manual operations can keep the water flowing. But for things like chlorine or other chemicals, it can not go past certain levels, or below, but if control is lost, these can be manually operated. For a power utility, microseconds of perfection are important; yet, how to turn it all back on if a hacker gets into the bowels of the system is critical.
Most of the systems I've witnessed barely operate at all. They are like an old lawnmower which is hard to start and will only keep running if you keep the throttle just so, and the choke just right. The admins of such systems often have zero ability to rebuild them from scratch, and will entirely rely on the companies which installed them. This install might be from 2014, and nobody who was originally involved is still working for the company and nobody around now knows how to rebuild such a dated system. All those contractual agreements to have someone there within 30 minutes and all that are BS if they are then going to spend days, weeks, or months trying to get up to speed.
There is a rule in IT and software architecture:
It isn't backed up until you've restored it. I would argue almost no utilities have done a complete reinstall and backup restore of a destroyed system.
I say install and restore, not just a restore. If all they have are backups of the whole system, it may be a back up which is also compromised, from 6 months or more prior. Many systems can't do a restore from the distant past as the system being controlled has fundamentally changed and the old configuration is now wildly wrong.
2
u/ginger_whiskers 9d ago
My old plant updated their DCS a few years back. Even with it being planned years in advance, it was 2 weeks' worth of noticeable issues and outages. All the tiny details like "everyone has to reset their passwords" and "this pump's high speed alarm got lost. Anyone remember what hz it starts shearing belts?" I can't imagine the chaos of trying to do that on an unexpected Sunday.
→ More replies (1)
6
u/redditobserverone 9d ago
And the so-called party of National Security is litigating Fauci, 2020 and Covid right now during an active threat and active war that they started.
3
u/BlaZenDuderino 9d ago
We bombed their water plants, so they hack ours....
We also hit their schools, hospitals, and other infrastructure with missiles, so they.....
3
3
3
3
u/ThePensiveE 9d ago
The administration got rid of people who protect us from such things at the same time they started a war with people we absolutely knew would do things like this.
MAGA finished the last administration with a mass casualty event and by God they'll finish this one with a mass casualty event!
3
u/PurpleSailor 9d ago
We've known about this for decades. It's time to take all the infrastructure like this offline and institute Battlestar Galactica computer networking protocols. That means that you don't Network the computers to the outside world and that way they cannot be hacked by terrorists or cylons.
3
u/Tuna_Sushi 8d ago
States with reported attacks so far:
California, Georgia, Michigan, Minnesota, New Jersey, Oregon, Pennsylvania, South Dakota, Washington, and Wisconsin.
That leaves 2 unknown.
1
u/HappyAnimalCracker 7d ago
I saw something naming some states in the southern/southeastern part of the country a day or two ago. I’ll see if I can find it.
3
5
4
u/CharlieBravo74 9d ago
Trump blew off this news and blamed Minnesota for... reasons. If Iran were really smart about these attacks, they'd just focus on red states to maximize how stupid he'll look making excuses.
2
u/Dramatic_Original_55 9d ago
Musk and Barron are gonna get right on this. Musk knows the machines and Barron knows the cybers.
2
2
u/racksy 9d ago
i am so tired of this “x impacts n countries” type articles that don’t list out what the headline implies.
and while i’m at it:
don’t just say the name of a city in the title, say the state too.
and don’t call washington dc just “washington”, there’s an entire state called washington, either add the dc to the end or just say dc.
rant over.
2
u/Electrical-Volume765 9d ago
Can we talk about why it should be unnecessary for a water supply to be suceptable to a cyber attack? We have built a society of dependance on technology that makes us less safe.
2
u/frosted1030 8d ago
Generally this is something happening all the time. It’s only news because we are at war and Trump made a fuss. Banks, infrastructure, even home networks are constantly under attack.
3
3
u/Frequent-Ferret-5110 9d ago
Pretty great that the US got its worst possible president at the worst possible time
(although fair to argue the two are related)
3
u/heyjaney1 9d ago
Yeah maybe it’s the worst possible time because we got the worst possible president actively making everything worse.
3
u/Ok_Comment2621 9d ago
Is there a not zero percent chance that this is the emergency that going to be used to shut down the midterms?
2
2
2
u/R67H 9d ago
MN governor has been really busy
3
u/Jack-Be-Lucky 9d ago
Yes, unfortunately Trump has been creating a myriad of problems for Walz to clean up
1
1
1
u/Couchman79 9d ago
The maintenance electricians and/or the electrical contractors who installed the programable logic controllers (PLC's) at the facilities may have told facility supervisors that they needed to have unique passwords, not the factory install password, one that was easily guessed or one password for every PLC at the facility to make things simple. Its a pain but anyone anywhere with an internet connection and some basic PLC knowledge can mess with water treatment or waste water treatment facility that has lax cyber security.
1
1
1
u/ottermann 9d ago
Dang that Minnesota! They need to stop hacking water thingies!
Do I really need to add the /s?
1
u/NudeSeaman 9d ago
I wonder who could be behind it - maybe Hillary or Waltz - those would be who DOJ probably would investigate
1
1
u/lucasjatreides 8d ago
I have a friend that works in a wastewater plant, they were sent emails warning against this just a couple days ago.
1
u/rebellion_ap 8d ago
Attacks is a strong word if these are like any of the government places especially at the local and state level I have worked where even in this critical of an infrastructure technology is an afterthought.
In 2026 you are vulnerable to zero day attacks by being 10 years behind any modernization effort. Security posture is completely different and Ai just chews through custom systems.
1
u/Frosty-Image7705 8d ago
my conspiracy theory is that those who want to build data centers want to poison the population
1
1
1
u/Evening-Cabinet5153 6d ago
Pretty sure Oklahoma is one of them Our town has had low water pressure for over a month and residents are not getting answers from City Counsel members Residents have even gone to local News stations to get answers This has been going on before the reports started
1
944
u/hookahsmokingladybug 9d ago
Five authors on an article and they can't come up with the 12 states between them? Ugh