Iran-linked hackers disrupt US water and energy providers: government advisory

The U.S. government has issued an updated advisory warning that hackers linked to Iran are actively disrupting American water and energy providers. The advisory, released by the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Environmental Protection Agency (EPA), states that Iranian state-sponsored actors have been exploiting vulnerabilities in systems used by these critical infrastructure sectors. The hackers are targeting programmable logic controllers and human-machine interfaces, which are essential for controlling water treatment and energy distribution processes.

The advisory affects water and energy providers across the United States, particularly those using equipment from Israeli companies or other systems that may be perceived as targets. The government warns that these attacks could lead to operational disruptions, including the manipulation of water treatment chemicals or the shutdown of energy supplies. This matters because such disruptions could threaten public health and safety, as well as the reliability of essential services that millions of Americans depend on daily.

According to the advisory, the hackers have been active since at least 2020, with recent incidents reported in 2023. The advisory does not specify the exact number of affected providers but notes that the campaign is ongoing and widespread. The government urges water and energy providers to implement immediate security measures, such as changing default passwords, updating software, and segmenting networks to limit access.

Background information indicates that this is not the first time Iranian hackers have targeted U.S. infrastructure. Previous advisories have warned of similar threats to the energy sector, and the current advisory builds on those earlier warnings. The likely next steps include increased monitoring by federal agencies and potential sanctions or other actions against the hackers. Providers are also expected to enhance their cybersecurity protocols to prevent future intrusions.