Overview:
Federal authorities have reported that municipal water systems in up to 12 states faced recent cyberattacks, though no disruptions occurred in Massachusetts. Athol Public Works Director Paul Raskevitz stated the town remains secure following a $40,000 state grant used to upgrade cybersecurity systems and hardware.
ATHOL – Federal authorities say municipal water systems in as many as a dozen states have been the targets of cyberattacks in recent weeks.
As of July 30, the FBI confirmed attacks in at least seven states, with reports in recent days indicating the number may be up to 12. Thus far, no communities in Massachusetts have reported disruptions.
Athol Public Works Director Paul Raskevitz said that Athol residents have nothing to worry about. Within the last year, he said, the town had received a $40,000 grant from the state Department of Environmental Protection (DEP) to update cybersecurity for the town’s water system.
“And then we participated in a cybersecurity checkup for our water system through the DEP and the federal EPA (Environmental Protection Agency),” he added.
“As with everybody involved in public service and public safety, we try to be as proactive as we can be and try to capitalize on any and all grants available through the DEP and EPA,” Raskevitz said. “With the grant, we were able to upgrade some of our SCADA (Supervisory Control and Data Acquisition) systems. Everybody the water and sewer ‘business’ use SCADA controls, and so were able to upgrade both our software and our hardware.”
According to an announcement issued July 30 from the Cybersecurity and Infrastructure Security Agency, an increase in cyber threat actors targeting programmable logic controllers (PLCs) in the water and wastewater systems has been observed. Infrastructure owners, operators, and integrators are urged to remove publicly exposed PLCs and other operational technology from the internet as soon as possible.
“Threat actors targeting exposed PLCs have modified passwords to lock out operators and disconnected the PLCs by changing their IP addresses,” the agency said in a statement. “This activity has resulted in boil water notices and sustained manual operations.”
Raskevitz went on to say, “When it comes to our cybersecurity checkup, we did very well prior to receiving the grant and we scored even higher afterwards. We take our cybersecurity super serious. We have multiple layers, multiple log-ins – all password protected – multi-factor specifications. We make constant updates and we do checkups quite often.”
Along with helping cover the cost of security upgrades, said Raskevitz, the grants also paid for training for staff through multiple sessions.
The DPW director added his department gets regular updates and alerts from the state DEP, federal EPA, and federal CISA.
“More recently, there has been a lot more communication from DEP and EPA, and there have been a lot of Zoom calls to water systems regarding things we should be looking for,” he said.