Michigan Reports Water System Cyberattacks, Joining 7 Other States

Michigan has joined a list of at least seven states that have reported cyberattacks on their water systems over the past week.

Dale George, director of communications for the Michigan Department of Environment, Great Lakes and Energy, said Michigan received the FBI’s notice to states last week, warning of “attempts to tamper with operational technology at water systems.”

“Following that notification, we received a small number of reports from Michigan communities indicating activity consistent with what federal agencies described. All systems continued to operate safely, issues were addressed by local operators, and there are no known impacts that posed a public health concern,” George told The Epoch Times via email on Aug. 2.

The FBI said that from July 27–30, water and wastewater utility companies in at least seven states had reported incidents.

The FBI and Environmental Protection Agency are warning that cyberattackers are targeting internet-connected programmable logic controllers used by water and wastewater utilities.

The agency said attackers have targeted internet-facing Rockwell Automation and Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers. After gaining remote access, the attackers changed passwords and internet protocol addresses.

Some of the effects reported to the FBI included loss of pressure. Federal officials warned that a significant loss of pressure can allow untreated groundwater to enter drinking water pipes through leaks or cracks. The severity of any disruption depends on the affected equipment and whether utilities can switch to manual operations.

Federal agencies urged utilities to remove the controllers from direct internet exposure and protect them behind secure gateways and firewalls.

Multiple states have reported attacks that changed device passwords and IP addresses, disrupting operators’ ability to monitor and control water systems. Some incidents caused pressure loss and flooding. The agencies urge utilities to remove programmable logic controllers from direct internet access, use strong passwords, restrict network access, review systems for unauthorized changes, and prepare to operate manually if needed. The FBI is asking affected organizations to report similar incidents immediately.

The City of Braham in Minnesota said on July 27 that a malicious cyberattack temporarily disrupted its computerized operating systems.

Officials said the attack shut down operating controls for the well and treatment plant but did not affect water quality, damage the facility, or alter physical systems.

During the outage, the city relied on water stored in its water tower to provide service to residents. Officials said at least four other communities were targeted in similar attacks. The State of Minnesota is assisting with the investigation and efforts to identify vulnerabilities and determine the source of the malware.