Feds issue warning to local water systems over increased cyberattacks, following Minnesota incident
Minnesota systems may have been targeted by Iranian groups, U.S. officials say.
The federal government issued a warning Thursday about potential cyber threats to water systems after 30 water plants in Minnesota were hit with cyberattacks that multiple U.S. officials tell ABC News may have been linked to Iran.
The Cybersecurity and Infrastructure Security Agency (CISA) said in an alert that cyber threat actors are targeting programmable logic controllers (PLCs) and modifying passwords to "to lock out operators."
"This activity has resulted in boil water notices and sustained manual operations," CISA said.
The alert comes two days after Minnesota officials revealed state water systems were hit with a cyber attack on Sunday and Monday.
Federal and state authorities are investigating whether Iran or hackers associated with the country were behind the attacks, multiple U.S. officials told ABC News.
The officials told ABC News they are also waiting for a more detailed level of forensics from the hack.
They stressed that the analysis is preliminary, and another official says that the U.S. has not made any formal announcement or determinations on who might be behind the cyberattacks.
The probe into the Iranian connections was first reported Thursday by The New York Times.
Minnesota IT Services (MNIT) provided more details about the attack Thursday and said it targeted systems to remotely monitor and control equipment, including the PLCs.
"In this situation, 'impacted' means investigators confirmed malicious activity involving a system’s technology. It does not mean every affected community experienced a disruption to water service," the agency said in a statement.
There are no active requests from Minnesota localities for residents to change their water use, MNIT said.
"We have provided relevant information to the federal government, which is evaluating this activity in the broader national context and leading efforts to determine whether it can be attributed to a specific threat actor," John Israel, Minnesota’s chief information security officer, said in a statement.
The hacks in Minnesota mirror a similar pattern carried out in other states by suspected Iran-linked actors.
The FBI said in a statement that the agency is aware of the intrusions but did not assign responsibility.
CISA urged water utilities to protect themselves including disconnecting PLCs from the internet and to run the system through a VPN or gateway device if they need to use remote access capabilities.
-ABC News' Ben Stein contributed to this report.