EPA links rising attacks on water utilities to unchanged passwords and exposed controls

Hall said the problem starts at the network edge. Aging control equipment in drinking water systems is "often left open to the open internet and not protected by any specific firewalls or virtual private networks that would ensure that cyber attackers cannot easily manipulate those," he said ^[7]. Kramer said the most common findings include "failure to change passwords, lack of multi-factor authentication" and critical system information that is "easily accessible" online ^[6]. When one system has both an exposed screen and an unchanged password, the intrusion needs no exploit code. The attacker just logs in ^[6][7].

Hall also described what attackers do once they are in. They are increasingly "manipulating the human-machine interface to change critical settings which disrupts the service and also puts people at risk," he said ^[4]. Behind those interfaces sit the programmable logic controllers that run pumps and valves. EPA and its law enforcement partners have issued advisories about those controllers ^[8]. Officials said drinking water stayed safe in both the Minnesota and Colorado incidents ^[11].

The claim that attacks are rising rests on Kramer's interview. "There is definitely been an increase, several fold on attacks recently," she said ^[1]. She did not give a baseline year or an attack count. The reporting also does not attribute the Minnesota attack or name the foreign actors in Colorado ^[9][10]. EPA's vulnerability total is the firmer number. It counts weaknesses the agency found at utilities ^[5].

In both public incidents, attackers reached the systems that control equipment ^[9][10]. Hall said attackers have moved from extortion toward disruption, and both incidents fit that description ^[3]. With no attribution on the record, the evidence supports a sector-wide change in what attackers target. It stops short of showing one actor's campaign maturing.

Hall blamed the gaps on money. "We will see water systems left vulnerable to cyberattacks where there have not been significant amounts of investment in cybersecurity protocols," he said ^[12]. Kramer said workforce shortages make it harder for utilities to recruit and retain people with the expertise to defend their networks ^[13].