What we know about the alleged Iranian hacks on U.S. water utilities

The reality is that some systems inside critical infrastructure facilities are exposed to the internet and relatively easy to find. Earlier this month, cybersecurity firm Forescout reported finding more than 2,800 controllers in U.S. water systems exposed online. If a system is exposed, it doesn’t automatically mean hackers can take over control and cause real-world effects. But that has happened in some isolated cases in recent attacks.

The FBI said some of the cyberattacks around the country caused loss of pressure, which “could potentially allow untreated groundwater to seep into pipes,” and flooding. 

The town of Braham in Minnesota, one of the first ones to report an incident, had to take its water plant offline for a few hours, urging its around 1,700 residents to conserve water. The city of Maple Plain, also in Minnesota, briefly declared a state of emergency. In a county outside Atlanta, Georgia, local officials briefly told residents to boil water before using it as a precautionary measure.  

The worst effect, however, may be psychological. These attacks have been widely covered in national and local press, causing people to worry about the safety of a fundamental and basic need like water. That may very well be part of the hackers’ goals: to spread panic and fear.