CISA has issued an emergency alert after Russian state-sponsored hackers launched coordinated attacks against water treatment systems in 6 US states, temporarily disrupting chemical treatment processes.

The Attack

The attackers exploited vulnerabilities in industrial control systems used by small and medium-sized water utilities. In two cases, chemical dosing levels were briefly altered before operators intervened.

Response

The FBI and NSA are working with affected utilities. CISA has mandated emergency cybersecurity audits for all US water systems serving over 10,000 people within 90 days.