A water utility that serves 300,000 homes and businesses in metro Atlanta is still investigating whether a hacker caused a service outage last week.
That July 27 shutdown in northern Clayton County occurred the same day that water utilities in at least seven states started reporting incidents to the federal government involving the computers that automate their processes.
On Thursday, the FBI and Environmental Protection Agency issued a joint announcement that “malicious cyber actors” had been attacking utilities’ programmable logic controllers, or PLCs, sometimes degrading water operations.
The attacks reportedly caused flooding and loss of water pressure, which can allow untreated groundwater to seep into service pipes.
That is what happened for three hours after midnight in Clayton County, when the water authority had to issue a boil-water advisory for several communities after a pump station failed.
“We’re still investigating what exactly caused the outage,” Erin Thomas, the spokeswoman for the Clayton County Water Authority, said Tuesday. “Some of our equipment just lost power, so we can’t confirm that somebody hacked into it. “
Thomas said that kind of failure had never happened before.
“Most of the time when you have any type of outage of that sort, it’s typically due to a main break,” Thomas said, adding that the authority’s technology experts were trying to determine whether the PLCs were involved.
The joint announcement by the FBI and EPA last week did not identify the hackers, but a previous advisory from another federal security agency blamed Iran.
The July 22 bulletin from the Cybersecurity & Infrastructure Security Agency updated an original warning from April. The agency warned that “ongoing Iranian-affiliated cyber targeting of internet-connected operational technology,” including PLCs, had been disrupting “several U.S. critical infrastructure sectors.”
The agency, which is part of the Department of Homeland Security, advised U.S. organizations to “urgently review” their systems for indications of intrusion.
The FBI recommended last week that operators lock down their PLCs with firewalls, strong passwords and restrictions on who can access them.
The potential connection between Iran, multi-state infrastructure hacks and Clayton County was first reported Monday by WSB-TV in Atlanta.
The news station reported that a Georgia Tech professor and his researchers had identified thousands of programmable logic controllers that had been configured in a way that made them vulnerable to online hackers. The professor, a cybersecurity expert, told the news station his lab had alerted 7,000 institutions.
A spokesman for the FBI in Atlanta told Capitol Beat by email Tuesday that the agency was aware of the security concerns about water service.
“The FBI and our interagency partners are fully engaged to protect critical infrastructure and we remain well-equipped to protect against cyber threats of all varieties,” he wrote.
This story available through a news partnership with Capitol Beat News Service, a project of the Georgia Press Educational Foundation.
