American Water Cyberattack renews focus on critical infrastructure protection

A cyber attack continues to affect the largest regulated water and wastewater utility in the United States, renewing the focus on the importance of protecting critical infrastructure sites.

New Jersey-based American Water stopped billing customers when it announced the cyber attack on Monday. It said it became aware of the unauthorized activity on Thursday and immediately took protective measures, including shutting down certain systems. Water services were not affected as protections remained in place Wednesday.

The company — which provides drinking water and sanitation services to more than 14 million people in 14 states and 18 military installations — said it did not believe its facilities or operations were affected by the attack, although employees were working “around the clock” to to investigate its nature and purpose.

The attack against American Water appears to be an “IT-focused attack” more than an operational one, according to Jack Danahy, vice president of strategy and innovation at Colchester, Vt.-based Vermont-based NuHarbor Security.

“People haven’t traditionally thought of infrastructure like water and wastewater services as being prone to threats, but incidents like this show how quickly problems can arise,” Danahy said. “As billing and other services have become more accessible to customers in recent years, they are now exposed to more types of risks and concerns that did not exist before.”

The US Cybersecurity and Infrastructure Security Agency and the Environmental Protection Agency have called on water systems to take immediate action this year to protect the nation’s drinking water. About 70 percent of utilities inspected by federal officials recently violated standards designed to prevent violations or other intrusions, the EPA said.

Copyright 2024 Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.

TOPICS
Cyber