Source-linked AI summary
A Review of Cybersecurity Incidents in the Water Sector
Amin Hassanzadeh, Amin Rasekh, Stefano Galelli, Mohsen Aghashahi, Riccardo Taormina, Avi Ostfeld, Katherine Banks
TL;DR
A comprehensive public compilation of water-sector cybersecurity incidents was lacking, limiting access to lessons that could inform cyberdefense efforts. The review selected detailed, verified accounts of disclosed, documented malicious incidents from public sources and compiled each case’s situation, response or recovery when available, and lessons learned. The reviewed incidents targeted diverse water systems, and incidents since 2017 appear more complex, with IT systems serving as entry points to victims’ networks.
Problem
A comprehensive public compilation of water-sector cybersecurity incidents was lacking, limiting access to lessons that could inform cyberdefense efforts.
Source: §1 · p. 2Method
Results
The reviewed incidents targeted diverse water systems, and incidents since 2017 appear more complex, with IT systems serving as entry points to victims’ networks.
Source: §5 · p. 12Takeaways & Limitations
Recent water-sector incidents (since 2017) appear more complex, with IT systems becoming more interesting targets and entry points to victims’ networks.
Source: §5 · p. 12The review may not include all incidents because many are not made public.
Source: §6 · pp. 12, 14
Abstract
from arXiv · showhide
This study presents a critical review of disclosed, documented, and malicious cybersecurity incidents in the water sector to inform safeguarding efforts against cybersecurity threats. The review is presented within a technical context of industrial control system architectures, attack-defense models, and security solutions. Fifteen incidents were selected and analyzed through a search strategy that included a variety of public information sources ranging from federal investigation reports to scientific papers. For each individual incident, the situation, response, remediation, and lessons learned were compiled and described. The findings of this review indicate an increase in the frequency, diversity, and complexity of cyberthreats to the water sector. Although the emergence of new threats, such as ransomware or cryptojacking, was found, a recurrence of similar vulnerabilities and threats, such as insider threats, was also evident, emphasizing the need for an adaptive, cooperative, and comprehensive approach to water cyberdefense.
1. Introduction
Cybersecurity incidents threaten a nationally important water sector, yet incidents may go undetected or undisclosed, and many utilities lack dedicated cybersecurity specialists. The review compiles incidents and their lessons to inform cyberdefense efforts.
1. Introduction
- From 2012 to 2015, water and wastewater systems received the highest number of ICS-CERT assessments among the covered sectors, except in 2014, when energy was slightly higher.DHS considered the sector a main cyberattack target among 16 lifeline infrastructure sectors and its safeguarding a national priority.Source: §1 · p. 1
- Undetected or undisclosed incidents, combined with a shortage of dedicated cybersecurity specialists, complicate water-sector protection.The paper notes that disclosure may jeopardize victims’ reputations, customer trust, and revenues.Source: §1 · p. 1
- A comprehensive public compilation of water-sector incidents was not available, despite the value of lessons from past incidents for cyberdefense investments.The paper identifies comprehensive compilation and review as needed to disseminate those lessons.Source: §1 · p. 2
- The study reviews disclosed, documented, malicious incidents alongside ICS architectures, attack-defense models, and security solutions, then reports incident situations, responses, remediation, and lessons.It also concludes with recommendations for industry, policy makers, and the research community.Source: §1 · p. 2
2. Industrial control networks
The section establishes the network context used to analyze incidents, from traditional SCADA arrangements to converged IT/OT and zoned ICS architectures. It highlights security risks arising from integration and the operational constraints on remediation.
2. Industrial control networks
- ICS analysis is grounded in traditional OT networks, their integration with IT networks, and standard ICS architecture designs.These architectures are later used to map attacker activities to layers and targeted hardware or software.Source: §2 · p. 2
- In water systems, geographically dispersed RTUs and PLCs communicate remotely with SCADA servers at a central control station.Field elements such as valves or pressure gauges are monitored by the RTUs.Source: §2 · p. 2
- IT/OT integration raises security risks because the networks have different priorities, ICS devices often lack security features, legacy equipment limits visibility, and operational constraints can delay remediation.OT availability priorities may conflict with IT confidentiality priorities, while safety and real-time operations can prevent immediate system interruptions.Source: §2 · p. 2
- Converged ICS networks are no longer air-gapped; ISA-62443 represents them as zones of IT and OT assets across multiple levels.The paper describes the enterprise, manufacturing, and control zones as parts of this architecture.Source: §2 · p. 2, Figure 1 · p. 3
3. Attack and Defense Models
The section introduces attack and defense models as context for understanding incidents. It describes attacks across converged IT/OT domains and presents security controls as complementary mechanisms rather than a single solution.
3. Attack and Defense Models
- The section frames attack-defense models as context for interpreting the reviewed incidents.The models are introduced to support more effective comprehension of the incidents.Source: §3 · p. 3
3.1. Attack models
- The ICS Kill Chain combines ISA-62443 architectural levels with Cyber Kill Chain steps, while the spiral model captures repeated steps and lateral movement toward an OT target.The model is generic: attacks may begin at other levels, including through an insider or a vulnerable DMZ server.Source: §3.1 · p. 3
- An activity thread represents a multi-step attack as a directed graph of intrusion events linked from the first step to the final target.Each event is described through core, meta, and expanded-meta features.Source: §3.1 · pp. 3–4
3.2. Defense models
- The defense discussion presents CIS Controls as security actions and maps control effects to detecting, denying, disrupting, degrading, deceiving, or containing attacks.Controls can be applied at different Cyber Kill Chain steps; trust zones can contain malicious activity, while honeypots can deceive attackers.Source: §3.2 · pp. 4–5
- OT-specific controls include unidirectional gateways, command whitelisting, passive asset discovery and intrusion detection, and patch and compliance management.These controls fit established control categories while being designed for OT protocols and standards.Source: §3.2 · p. 5
4. Incidents
The review selects verified, detailed public accounts of malicious water-sector incidents and reports situations, responses or recovery when available, and lessons learned. The cases include a sewage spill associated with unauthorized SCADA access and a suspected breach that could have affected treatment operations.
4. Incidents
- The review considers disclosed, documented, malicious incidents through May 2019, selecting cases with detailed, verified information from public sources without conducting direct investigations.Cases are presented chronologically; one false positive was included because of the negative “cry-wolf” effects following its disclosure.Source: §4 · p. 5
4.1.1. Incident
- Unauthorized SCADA interference at Maroochy Shire disrupted pump communications and controls and released nearly one million liters of raw sewage.The incident also polluted 500 meters of open drain in a residential area.Source: §4.1.1 · p. 5
4.1.2. Response and lessons learned
- Investigators traced the Maroochy faults to human intervention and a former contractor supervisor, who was convicted and ordered to pay for the damage.The review reports absent cybersecurity procedures, policies, and defenses, and says the service contract inadequately addressed the contractor’s responsibilities; it notes that terminating former employees’ network access is important.Source: §4.1.2 · pp. 5–6
4.2.1. Incident
- In 2006, the FBI suspected hackers used an employee’s infected laptop to install malware on a Harrisburg water-treatment plant computer, potentially affecting normal operations.The reported potential impact included altering potable-water disinfectant concentrations.Source: §4.2.1 · p. 6
4.2.2. Response and lessons learned
- After the Harrisburg incident, the utility eliminated remote access to the plant and changed all passwords.The account identifies the employee laptop as the entry point and notes that separating SCADA from internet-connected administrative networks can reduce penetration risk.Source: §4.2.2 · p. 6
4.3. Tehama-Colusa Canal, U.S., 2007
The Tehama-Colusa Canal incident involved an active employee who allegedly damaged a water-diversion computer, while a later suspected Illinois water-plant attack was determined to be a false alarm. The accounts emphasize the operational resilience of manual controls and the value of careful incident verification.
4.3.1. Incident
- The canal computer could still be operated manually after a former electrical supervisor allegedly accessed and damaged it to divert water.The employee was responsible for the computer systems and was later sentenced to 10 years in prison and fined.Source: §4.3.1 · p. 6, §4.3.2 · p. 7
4.3.2. Response and lessons learned
- The active employee installed unauthorized software on the SCADA system, causing more than $5,000 in damage.He was charged and sentenced to 10 years imprisonment and a fine.Source: §4.3.2 · p. 7
4.4.1. Incident
- The Illinois pump’s reported cyberattack was a false alarm: investigation found a history of malfunctions and no corroborating attack evidence.Extensive news coverage of the suspicion caused anxiety and a cry-wolf effect; considering travel and malfunction history sooner could have helped avoid it.Source: §4.4.1 · p. 7
4.5. Key Largo Wastewater Treatment District, U.S., 2012
These accounts describe unauthorized access involving an ex-CFO, a dam’s internet-facing control system, and smart-meter base stations. They also highlight credential control, exposure of control systems, and recordkeeping as recurring security concerns.
4.5.1. Incident
- The former CFO accessed the district’s computer system using other employees’ credentials, downloading emails and personal documents after his contract was not renewed.A routine email-system check revealed messages sent to his personal account; the attack remained limited to IT systems, without operational disruption.Source: §4.5.1 · pp. 7–8
- The CFO’s access from home suggested no second authentication factor was required; the review recommends two-factor authentication and extensive routine checks of sensitive systems.The source says it remains unclear how he obtained coworkers’ credentials.Source: §4.5.1 · p. 8
4.6.1. Incident
- Hackers accessed the Bowman Avenue Dam’s internet-connected SCADA system and gathered information while the sluice gate was disconnected for maintenance.The system was directly internet-accessible without a firewall or authentication controls, but the hackers could not directly control the gate.Source: §4.6.1 · p. 8
4.6.2. Response and lessons learned
- After the Bowman Avenue incident, new software and a sluice gate were installed; remediation cost over $30,000, though dam security and reliability were unaffected.The review points to the unsafe web application used to monitor and control the infrastructure.Source: §4.6.2 · p. 8
4.7.1. Incident
- A fired smart-meter company employee used network access to change base-station passwords and radio frequency and overwrite scripts, disrupting communications at five utilities.Utilities resumed manual data gathering; investigators could not link some anomalies because login details had not been recorded, and a default password had enabled access.Source: §4.7.1 · p. 8, §4.7.2 · p. 8
4.7.2. Response and lessons learned
- The smart-meter case underscores revoking access when employees leave and securely retaining login and activity logs to help identify earlier breaches.The review also identifies access controls as important because a default password allowed the former employee to access a base station.Source: §4.7.2 · p. 8
4.8. Kemuri Water Company (a pseudonym), U.S., 2016
The Kemuri Water Company assessment found vulnerabilities across its OT and IT systems, and investigators identified exploitation that affected customer records and water operations. The response included blocking connectivity and recommendations to replace outdated systems.
4.8.1. Incident
- The assessment found high-risk vulnerabilities in the utility’s OT and IT systems, including outdated computers and an AS400 connected to multiple networks.Staff interviews raised doubt about whether the investigation was fully proactive, because some staff knew of possible unauthorized access and unexplained valve patterns.Source: §4.8.1 · p. 9
- Investigators linked the internet-facing payment application to the AS400 and found exploitation followed by valve and flow-control manipulation and exfiltration of 2.5 million unique records.The incident also involved manipulation of chemicals and flow rates.Source: §4.8.1 · p. 9
4.8.2. Response and lessons learned
- The utility terminated access to the account-management web front, blocked AS400 outbound connectivity, and was advised to replace antiquated systems.The review also recommends separating internet-facing applications from SCADA, using multifactor authentication, patching, and monitoring data transfers for early detection.Source: §4.8.2 · p. 9
4.9. An undisclosed utility, U.S., 2016
The incidents range from suspicious network traffic at an undisclosed utility to compromised cellular routers and fraudulent customer refunds. Their accounts describe both technical response measures and investigative challenges involving logs and third-party access.
4.9.1. Incident
- Suspicious traffic from a pumping-station control panel prompted an undisclosed utility’s administrator to contact ICS-CERT and led to an official investigation.The response used address whitelists and non-standard ports to safeguard the network without taking the control interface offline.Source: §4.9.1 · p. 9, §4.9.2 · p. 9
4.9.2. Response and lessons learned
- Prompt reporting and administrator awareness helped isolate and thwart a potentially catastrophic intrusion, though key reverse-engineering findings were not disclosed.ICS-CERT collected forensic images and reverse-engineered malware to determine the attacker, breach point, compromised data, and mitigation strategy.Source: §4.9.2 · p. 9
4.10.1. Incident
- Four of seven cellular routers were compromised in an opportunistic bandwidth theft, with monthly bills rising from an average of $300 to $45,000 in December 2016 and $53,000 in January 2017.The incident was attributed in part to hard-coded credentials and failure to install patches; it caused no physical harm or infrastructure damage.Source: §4.10.1 · pp. 9–10
4.11.1. Incident
- A regional water supplier’s fraudulent refund scheme diverted over £500,000 after customer account and bank details were changed.The funds were transferred through accounts in Dubai and the Bahamas and converted to Bitcoin.Source: §4.11.1 · p. 10
4.11.2. Response and lessons learned
- Investigators traced the refund fraud to a call-center employee who stole account details and shared them with an aide, and both were convicted.The review says management should ensure partners with access to critical data conduct stringent employee background checks.Source: §4.11.2 · p. 10
4.12. A European water utility, 2018
The review describes a water utility’s cryptojacking incident and response, then contrasts it with a ransomware attack that encrypted another utility’s files despite existing protections.
4.12.1. Incident
- Nearly 40% of traffic was mining-related and bandwidth rose 60%, with no controller changes or commands reported.The investigation traced the traffic to a Monero mining pool.Source: §4.12.1 · p. 10
4.12.2. Response and lessons learned
- Suspicious network traffic exposed the cryptojacking; antivirus updates detected CoinMiner, and the utility tightened firewall security.High processor use, sluggish response times, and overheating are also identified as possible early-warning signs.Source: §4.12.2 · p. 10
4.13.1. Incident
- EMOTET infection preceded a RYUK ransomware attack that encrypted files and data; the authority rejected the ransom demand.The authority disconnected its facilities from the internet, but encryption still followed.Source: §4.13.1 · pp. 10–11
4.13.2. Response and lessons learned
- Despite firewalls and antivirus protection, the authority’s IT system was penetrated; it planned a ground-up rebuild and declined to pay.The no-payment decision accords with federal guidance against paying criminal actors.Source: §4.13.2 · p. 11
4.14. Fort Collins Loveland Water District, U.S., 2019
The Fort Collins Loveland district declined a ransomware demand and recovered access to its data, while the Riviera Beach attack disrupted city and water operations and prompted ransom payment and hardware replacement.
4.14.1. Incident
- The district declined the ransom after ransomware blocked access to technical data; daily operations and customer data were not believed compromised.The ransom amount was not publicly disclosed.Source: §4.14.1 · p. 11
4.14.2. Response and lessons learned
- The district unlocked its data within weeks and chose not to notify customers because it did not store their data; a vendor handled payments.The review notes that this vendor arrangement protected customer data but also creates risks, as seen in another incident.Source: §4.14.2 · p. 11
4.15.1. Incident
- An employee’s infected email triggered ransomware that spread from city systems to water pumping, water-quality testing, and payment operations.The attack also took city operations offline and encrypted data.Source: §4.15.1 · p. 11
4.15.2. Response and lessons learned
- The city authorized payment of 65 bitcoins, approximately $600,000, plus a $25,000 deductible, yet encrypted data remained inaccessible as of June 20, 2019.Two weeks after disclosure, water pump stations and water-quality testing were only partially available, requiring manual sampling; the city said water quality was never in jeopardy.Source: §4.15.2 · p. 11
- Outdated hardware and delayed patches were identified; the review highlights employee training and cites FBI and security-expert advice against paying ransom.The city authorized more than $900,000 for new hardware purchases originally planned for the following year.Source: §4.15.2 · p. 11
5. Discussion
The review finds that water-sector incidents have grown more complex and varied, involving diverse targets, impacts, and adversaries. It also identifies recurring security gaps, including insufficient organizational controls and limited proactive detection.
5. Discussion
- Water-sector attacks have shifted from direct insider access to OT controllers toward multi-step attacks compromising IT and OT workstations.The review contrasts the 2000 Maroochy Water Services hack with the 2016 Kemuri Water Company hack.Source: §5 · p. 11
- Reviewed incidents targeted diverse water systems and produced varied consequences, including pollution, irrigation-water theft, data breaches, and chemical-rate manipulation; no human casualties were reported.Primary investigators rarely came from the victim organization, which the authors say might indicate shortages of in-house security teams or trained personnel.Source: §5 · pp. 11–12
- Insiders recur among reported adversaries, including former employees or contractors who retained or gained unauthorized access; the review urges attention to employee behavior changes.The examples include attacks across multiple domains of five utilities.Source: §5 · p. 12
- Recent incidents often target databases, files, and account servers for financial purposes, while an identified state-sponsored attack exfiltrated data and manipulated chemical and flow rates.Incident 4 was a false alarm despite concurrent operational issues that confused investigators.Source: §5 · p. 12
- Incident 12 unusually deployed cryptocurrency-mining code on a utility’s OT network to use its machines’ computing resources.The code was most likely downloaded from malicious websites, according to the review.Source: §5 · p. 12
- The review finds no single defense sufficient and identifies gaps in organizational controls, proactive detection, and preventive mechanisms across incidents.It recommends using multiple critical-security-control mechanisms, including detect, deny, and deceive.Source: §5 · p. 12
6. Epilogue
The review covers 15 water and wastewater sector incidents over 2000–2019, spanning diverse vulnerabilities, systems, attackers, and consequences. That heterogeneity supports a need for comprehensive assessment and response research, while the incident review may not be exhaustive.
6. Epilogue
- The review covers 15 water and wastewater sector incidents from the 2000 Maroochy Shire insider attack to the 2019 Riviera Beach ransomware attack.The incidents span a wide variety of vulnerabilities and situations.Source: §6 · p. 12
- The diversity of systems, attackers, and consequences calls for inclusive vulnerability assessments and comprehensive risk mitigation, preparedness, response, and recovery studies.These studies should account for the sector’s extreme heterogeneity.Source: §6 · p. 12
- The review may not include all incidents; its framework is designed to accommodate future disclosures or incidents.Maintaining an online version of the repository is identified as a significant future endeavor.Source: §6 · pp. 12, 14