American Water says it identified "unauthorized activity" taking place within its computer networks and systems that was later determined to be a "cybersecurity incident" that deactivated and disconnected certain key elements of the system.
Once again demonstrating the risks involved with the tech revolution, the cyberattack resulted in a temporary billing pause for American Water customers, reports indicate, as the company's call center was left with "limited functionality."
The company says it is "working diligently" to get everything back in working order. There will also be a third-party investigation by cybersecurity professionals to determine what happened and why, a process that could take a bit of time to resolve.
Because some 14 million people in 14 states rely on American Water for their taps to function, the company is also bringing in law enforcement to help conduct an investigation into the matter.
American Water says that neither its water or wastewater facilities and operations were negatively impacted by the cybersecurity attack, which the company says means its water is still safe to drink.
"Our dedicated team of professionals are working around the clock to investigate the nature and scope of the incident," company officials said in a statement.
"We sincerely regret any inconvenience this incident may cause, and we are working diligently to remediate and to bring these systems back online in a safe and secure manner."
(Related: Taiwan-based Gold Apollo plans to "sue Israel" for allegedly hacking the company's pagers to turn them into deadly explosives.)
Are foreign adversaries targeting American water supplies?
American Water reportedly manages some 540 different groundwater treatment plants in 1,700 U.S. communities. The 14 states in which American Water operates include:
• California
• Georgia
• Hawaii
• Illinois
• Indiana
• Iowa
• Kentucky
• Maryland
• Missouri
• New Jersey
• Pennsylvania
• Tennessee
• Virginia
• West Virginia
The latest reports indicate that some of the publicly-traded company's online systems, including its website and telecommunications system, are still non-operational as of October 8, this despite the cyberattack incident happening a full five days prior on October 3.
Keep in mind that American Water also provides water to 18 U.S. military installations, which means that they, too, are impacted by the prolonged outage. Some 6,500 people work for American Water.
The outages primarily impact American Water's customer-facing sites, including the "MyWater" customer portal which is still serving up blank pages that contain "Forbidden 403" text with no way to log in.
An attendant from the company's Camden, N.J., headquarters confirmed to Dark Reading that she cannot even connect with members of the media, nor can anyone leave a message for her, because American Water's telecommunications system "is down."
Critical infrastructure like water has been the subject of concern in recent years, specifically as it pertains to the threat of cyberattacks. Many have been warning for some time now that this kind of thing will happen more and more as hackers, possibly of the foreign enemy variety, target the country for destruction.
Recall what happened in May 2021 to the Colonial Pipeline when a ransomware attack left the fuel supply line non-operational. That same year in February, hackers also targeted a Florida water-treatment facility that, had an employee not noticed it an acted quickly, could have resulted in the public water supply being poisoned.
According to the Environmental Protection Agency (EPA), about 70 percent of the nation's community drinking water systems fail to comply with the Safe Drinking Water Act, which includes having cybersecurity safety measures in place to protect against crippling cyberattacks.
In the age of tech, cyberattacks threaten to destroy entire nations that rely on it to keep things running normally. Learn more at CyberWar.news.
Sources for this article include:
Please contact us for more information.
