Cyber Threats to Water and Wastewater Sector

The Strategic Imperative of Water and Wastewater Systems (WWS)

The Two Faces of Cyber Threats to Water Utilities

Based on past cyber incidents in the WWS sector, the two major motivations for adversaries are a) geopolitical disruption, and b) financial gain. For geopolitical disruption, one notable incident occurred in April 2020, where an Iranian-linked threat group attempted to manipulate the chemical levels at several Israeli water facilities. The attempt was to increase the chlorine concentration used in the water supply. While chlorine is used to purify water to make it safe for consumption, excessive chlorine in water can cause severe issues like nausea, vomiting, and has even been linked to an increased risk of cancer. The attack was detected and thwarted immediately by the authorities before any harm befell the public. However, it still caused a high degree of fear within the public towards water consumption. Fast forward to December 2023, another cyber incident occurred in Ireland, County Mayo, where hundreds of households in this coastal region suffered for two days from a water outage. The attack was conducted by shutting down a controller that helped to maintain water pressure, disrupting the water supply. Though this chaotic event was confined to a small region, it still demonstrates how capable adversaries are of causing serious disruption.

In addition to nation-state threat actors motivated by geopolitical disruption, the WWS sector is also under constant attack from cybercriminals pursuing financial gain. Ransomware groups have learned that disrupting OT environments like threatening the water supply can pressure victims to pay ransoms more quickly. United Kingdom water supplier, Southern Water, was forced to shell out millions due to a Black Basta cyberattack in 2024. While Southern Water claimed that only the IT system was impacted, the mere risk of water supply disruption was dire enough to force the company to pay the ransomware, as revealed by leaked internal chat logs from the Black Basta ransomware gang. Another UK water supplier suffered from a ransomware attack in 2022. In this incident, ransomware gang Cl0p claimed to have compromised South Staffordshire Water, providing proof in the form of two screenshots of the SCADA system used in the operation. While OT operations were not impacted in this incident, the leaked documentation may still increase the risk of future attack.

The Path of Least Resistance: How Adversaries Compromise Water Utilities

Based on the analysis of past incidents, we observed that many attacks were facilitated by internet-exposed OT assets that have default credentials and unpatched systems. This is the most critical pattern found within these incidents. Although these attacks were low in sophistication, they still had a significant impact on the WWS sector. Because water utilities are vulnerable to simpler methods, adversaries have little incentive to use advanced tradecraft. Take Iran’s CyberAv3ngers and pro-Russian hacktivists for example; they constantly scan and exploit internet-exposed PLCs and Human-Machine Interfaces (HMIs) to find default passwords and known vulnerabilities instead of developing and deploying an advanced zero-day exploit.

As an example of the low-effort attack tactics threat actors tend to employ, let’s look at what happened with the Unitronics Vision PLC. This PLC has been used extensively in WWS Sector facilities to control and monitor various stages and processes of water and wastewater treatment. This includes filling tanks and reservoirs by turning on and off pumps at a pump station, flow pacing chemicals (this means injecting or extracting chemicals from the water) to meet regulations, announcing alarms for operations and gathering compliance data for monthly reports. Considering how many functions this PLC is involved with, it was easier for attackers to find the vulnerability of this PLC among the KEV catalog than to build a cyberattack from scratch. The default password of Unitronics Vision series’ PLC was “1111” and the default TCP port was 20256 for communication. When the PLC is exposed to the internet, a threat actor can compromise the device by authenticating to it and using the Unitronics VisiLogic engineering workstation software to tamper with its intended functions. Actions taken by a threat actor after compromise may include:

• • erasing the original logic file to prevent the device from carrying out its intended operation
  • renaming the device to delay OT operators from accessing the device for recovery purposes
  • resetting the software version to block communications from engineering workstations

One may think that changing the default password is enough to prevent attacks, but the fact that the PLC is exposed to the internet means the attacker may still be able to exploit a wide range of other vulnerabilities. For example, the same Unitronics Vision™ series PLC is prone to a vulnerability that allows the password to be recovered in plaintext. Water utilities provide 24/7 water service, making it difficult to update the system to patch vulnerabilities. As a result, these PLCs are often at risk of having their known vulnerabilities exploited.

Besides the constant risk that comes from having directly exposed OT assets, attacks that spill over from IT environments are also common. Many water utilities have flat IT and OT boundaries with weak DMZ control, allowing attackers to easily move laterally from IT to OT assets. Another common case in this category are dual-homed assets that have access to both IT and OT. An incident in 2016 provides a notable example. The Kemuri Water Company had a customer-facing web application connected to a server, AS/400, which hosted both billing data and SCADA at the same time. As stated in the above verizon link, “KWC referred to this AS400 system as its ‘SCADA platform’. This system functioned as a router with direct connections into several networks, ran the water district’s valve and flow control application that was responsible for manipulating hundreds of Programmable Logic Controllers (PLCs), housed customer PII and associated billing information, as well as KWC’s financials.” In this incident, the attacker first exploited the web application with an easily identified vulnerability found in the payment application. After the web application was compromised, plaintext credentials were found on the system. Using these credentials, attackers were able to access the control applications used for valve/flow control. According to the report, the attacker managed to alter the amount of chemicals in the water treatment, a terrifying outcome.

The Dilemma of Water Utilities

So why is it so hard to implement effective security practices for water utilities? We found that there are several factors.

• • Highly fragmented OT assets, very few operators. A water utility is composed of several plant sites, including areas for a storage system and water treatment. Many of these plant sites are small and located in rural areas, and they have a limited budget for OT security personnel. Thus, many remote pump/lift stations operate without any human labor.
  • Centralized SCADA supervising covering many small sites. In OT, a master refers to the central SCADA master station that supervises and communicates with multiple RTUs, PLCs, or field devices across distributed sites. If there is only one master, that master can become a single point of failure for a whole service area.
  • Aging control assets and long lifecycles. PLCs/RTUs and radios often run 10–25 years; many lack modern authentication, logging, or cryptography.
  • Legacy protocols. Modbus is still a common protocol over radio/cellular and OPC UA security is unevenly deployed.
  • Tight availability windows. In OT, 24/7 processes with limited bypass options make maintenance windows scarce, leading to routine deferral of patching and firmware updates.
  • Remote access dependence. Vendor/contractor access is common; MFA and jump-host discipline are inconsistent.
  • Telemetry realities. Licensed/unlicensed radio and cellular links are widely used; shared keys, flat routing, or plaintext protocol tunneling are still seen.
  • Less prescriptive cyber compliance. Unlike electric power (NERC CIP) or many oil & gas majors (corporate/IEC 62443 programs with audits), water’s mandates are newer, variable by jurisdiction, and less rigorously enforced, especially for small systems.

To Achieve Better Hygiene

As a response to these escalating cyber threats against water utilities, there are two major frameworks that can be followed:

• • CISA, EPA and FBI joint direction.
    Reduce internet exposure, change default passwords, inventory IT/OT assets, back up systems, conduct regular assessments, train staff, and exercise IR/DR. EPA can supplement this with a 24/7 help desk, free third-party assessments, planning templates, training, and funding pointers (DWSRF/CWSRF; SLCGP).
  • European Union, NIS2.
    NIS2 requires a formal risk-management approach, incident handling, business continuity, and supply-chain security for essential entities—including water. National plans (e.g., ENS/ANSSI/BIO) reinforce risk assessments, monitoring, patching, strong auth/crypto, and DR planning.

Based on the above two frameworks, we conclude the following can be a reference for the minimum baseline for better security hygiene:

• • Eliminate public internet exposure. Remove direct access to HMIs/PLCs/VPN portals; place access behind authenticated remote entry with MFA; regularly verify that there are no exposed services.
  • Identity & credentials mitigation. Change all default credentials and enforce MFA for any remote administrative access. Time-box the vendor accounts and rotate passwords after contractor work.
  • Asset & protocol inventory. Maintain an ongoing live register of all servers, workstations, PLCs/RTUs, radios, firmware, and protocols.
  • Backups & restore. Keep offline/immutable backups of controller logic and supervisory servers, test recovery, and record results.
  • Reduce vulnerability exposure. Plan patch/mitigation cycles; replace end-of-support systems; request CISA free vulnerability scanning and EPA cyber evaluations to catch misconfigurations.
  • Plan, train, and exercise. Use EPA’s incident action checklists, IR guides, and tabletop exercise materials, schedule staff awareness training and review phishing hygiene. Record attendance and outcomes to demonstrate due care.

In short, we should generate a prioritized set, execute control actions, and leverage services to keep a concise record for security.