Cyber experts believe the cyber incident at American Water was a ransomware attack

A security specialist has speculated that a recent attack on the nation’s largest water utility, described as a “cyber incident” in its 8-K disclosure to the SEC, was triggered by ransomware.

American Water said it became aware of the incident on Oct. 3 after discovering a cyber incident in which the company detected unauthorized activity on its internal networks and immediately activated its incident response protocols.

According to the company’s website, the utility provides drinking water and wastewater to approximately 14 million people in 14 states, including 18 military installations.

The filing said it did not believe its drinking or wastewater facilities were negatively impacted by the intervention, adding that the company had taken precautions to protect its IT systems and data.

This included shutting down some systems, including the customer service portal MyWater, temporarily halting customer billing functionality.

Kevin Kirkwood, CISO at security and compliance specialist Exabeam, suspected that the shutdown was the result of a ransomware attack, noting that the disruption would likely have been far greater had access to the broader control systems been expanded .

“If I had to speculate, I would say that American Water may have been the victim of a ransomware incident. The company mentioned that it had shut down its billing systems, which points to backend systems internal to the company. Given the large segment of water and wastewater treatment facilities that American Water covers, if control systems were compromised, we would likely hear about plant shutdowns and boil water advisories in every state.

In one opinion In a notice posted on its website, the company assured affected customers that there will be no late fees or suspension of services while the portal system remains offline.

American Water added that it immediately brought in outside security experts to support the ongoing containment and containment process and was coordinating fully with law enforcement.

Threat actors continue their attack on US water utilities

Andrew Lintell, GM for EMEA at industrial cybersecurity specialist Claroty, noted that while the access described in the filing appears to have been limited, the impact of such attacks on public utilities could still be significant, including significant damage to their public perception.

“Although American Water Works has prevented major damage by preventing direct impacts to its water assets, the impact on customer services such as billing systems and call centers shows that even partial system failures can cause significant disruption and reputational damage.”

The event is the latest in an ongoing spate of attacks on key U.S. national infrastructure, with water facilities being targeted as cyber attackers seek to sow disruption and undermine trust in the country’s public sector.

At the beginning of the year, the national cyber agency CISA together with international partners warned It had observed the China-linked threat actor Volt Typhoon establishing and maintaining a presence in water companies’ IT environments for at least five years.

Lintell added that the attack on American Water was likely the work of a similar person state-sponsored attacker and part of a broader campaign targeting OT environments in the region.

“Assuming we learn that this is the work of a state actor, it would be part of a larger trend where they are increasingly targeting smaller utilities as part of a broader strategy to infiltrate operational technology (OT) environments.

“From remain undetected within a networkThese actors can sit and wait for a future opportunity to trigger a major event. Such efforts are part of a broader destabilization strategy aimed at sowing insecurity and undermining trust in critical infrastructure,” he explained.

Apalachee High School is playing its first home football game since the Sept. 4 shooting that left f...

Kezar reports the deaths of four patients in a study of intermediate-stage lupus nephritis and suspe...

Judges will not reconsider the property's liability claim for a skier's fatal accident

Cyber experts believe the cyber incident at American Water was a ransomware attack

Related posts:

By Hudson Brooklyn

You Missed

US charges duo behind Anonymous Sudan for over 35,000 DDoS attacks

Judge sentences Rolla-Mann to 190 months in prison for images of child abuse

Two election officials in a rural Virginia town are suing the state over voting machines

Video shows attack on Autauga County school bus; One in custody

Cyber ​​experts believe the cyber incident at American Water was a ransomware attack

Related posts:

By Hudson Brooklyn

Related Post

US charges duo behind Anonymous Sudan for over 35,000 DDoS attacks

Judge sentences Rolla-Mann to 190 months in prison for images of child abuse

Two election officials in a rural Virginia town are suing the state over voting machines

You Missed

US charges duo behind Anonymous Sudan for over 35,000 DDoS attacks

Judge sentences Rolla-Mann to 190 months in prison for images of child abuse

Two election officials in a rural Virginia town are suing the state over voting machines

Video shows attack on Autauga County school bus; One in custody

Cyber experts believe the cyber incident at American Water was a ransomware attack