" class="fuel_embeded_code_2619016">
INDIANAPOLIS (WRTV) - The FBI warns that cybercriminals are targeting water systems nationwide, prompting utilities across Indiana to prepare for potential threats.
At least 12 states, including Michigan and Minnesota, have reported cyberattacks on water utilities. Hackers are attempting to disrupt critical infrastructure, such as drinking water and wastewater systems.
While no specific threats have been reported in Indiana, local water systems are taking precautions.
Citizens Energy Group, a major utility handling wastewater and drinking water for 900,000 customers in Indianapolis and some adjacent counties, has a cybersecurity team working to prevent disruptions. The company uses controllers with sensors to operate equipment like pumps, motors, and valves. The FBI warns that hackers target these controllers by remotely accessing devices connected to the internet, changing IP addresses, and resetting passwords.
These attacks can lead to serious issues, such as flooding or a loss of water pressure. The FBI also expressed concern that untreated groundwater could seep into pipes during a system failure. In response, the bureau issued a list of security recommendations for utilities. Citizens Energy officials say they already follow these best practices.
Ben Easley, a spokesperson for Citizens Energy, explained that the utility keeps its business and email networks completely separate from the critical controls that manage water and gas services. He emphasized that systems remain secure despite the modern internet's interconnected nature.
"Our message to our customers is that our systems are safe and secure," Easley said.
He noted that as a provider of critical services, the utility must maintain a strict barrier between the general internet and its operations to protect Central Indiana customers from those with "ill intentions."
Citizens Energy and other utilities are also collaborating with the state's new Office of Cybersecurity. Alyssa Schroeder, the office's interim director, said the primary threats come from hackers looking to disrupt essential services like water, energy, banking, and telecommunications.
The city government of Carmel is working with the federal government on a utilities assessment to improve cybersecurity. In a statement, the city said it maintains an active program to identify, monitor, and protect its technology assets from emerging risks and suspicious activity.
Indiana American Water also reported that it is continually strengthening its systems. The company is the first U.S. water and wastewater provider to earn the U.S. Department of Homeland Security's Support Anti-terrorism by Fostering Effective Technologies (SAFETY) Act designation, one of the highest levels of federal accreditation for anti-terrorism efforts.
Cybersecurity experts say these incidents highlight the need to shore up essential infrastructure.
Mark Rorabaugh, CEO of the cybersecurity firm InfraShield, said water and wastewater systems are increasingly caught in global cyber conflicts, even when they are not the primary targets. He noted that much of the technology used by utilities was not designed to handle modern cyber threats.
Rorabaugh suggested that utilities need a "layered resilience strategy." This includes separating network segments, continuous monitoring, and keeping recovery options offline to reduce exposure to the internet.
"The City maintains an active cybersecurity program focused on continuously identifying, monitoring and protecting the devices and systems connected to our environment.
"This includes maintaining visibility into our technology assets, identifying vulnerabilities and emerging risks, applying security updates and protections, monitoring for suspicious activity and responding to issues as they are identified.
"Cybersecurity is an ongoing process citywide, and our approach is designed to continually evaluate our environment and strengthen protections as technology and threats evolve."
"Cybersecurity is a continuous threat facing U.S. water and wastewater systems today. American Water takes the cybersecurity of our systems and related data with utmost seriousness and continually takes steps to strengthen the cybersecurity of its systems. Our customers remain our highest priority.
"The company is continuously evolving its cybersecurity program to adapt to the changing cybersecurity threats faced by the water sector and maintains close relationships with our local, state, and federal partners to prepare for cyber threats.
"American Water is the first U.S. water and wastewater company and the third utility to earn the Support Anti-Terrorism by Fostering Effective Technologies (SAFETY) Act designation. It serves as one of the highest levels of accreditation offered by the Department of Homeland Security that promotes the development and deployment of effective anti-terrorism products, systems and services."