Cyberattacks targeting water utilities across the country have increased in frequency and severity, the U.S. Environmental Protection Agency warned Monday as it urged community water systems to take immediate steps to reduce cybersecurity vulnerabilities and protect the nation’s public drinking water supplies.
The EPA has issued an enforcement alert detailing “urgent cybersecurity threats and vulnerabilities” to community drinking water systems, the agency said in a news release Monday. A majority of water systems — over 70% — inspected by the EPA since last September violated standards in the Safe Drinking Water Act, according to the alert.
The Safe Drinking Water Act was established to protect public health by regulating public drinking water supplies in the country, according to the EPA. Among those inspected, the agency identified “alarming” cybersecurity vulnerabilities in some water systems.
The agency found that some water systems failed to change default passwords and cut off access to former employees in addition to only using single logins for all staff that can be compromised, the alert said. Although many of the EPA’s requirements to protect water systems are “basic cyber hygiene practices,” the agency said potential cyberattacks can cause significant impacts on both water utilities and consumers.
The EPA also recommended that small water systems improve protections against cybersecurity threats, noting that disruptive cyberattacks have impacted water systems of all sizes. Recent cyberattacks by organizations affiliated with Russia and Iran have targeted utilities in Pennsylvania and Texas.
“Protecting our nation’s drinking water is a cornerstone of EPA’s mission, and we are committed to using every tool, including our enforcement authorities, to ensure that our nation’s drinking water is protected from cyberattacks,” EPA Deputy Administrator Janet McCabe said in a statement. “EPA’s new enforcement alert is the latest step that the Biden-Harris Administration is taking to ensure communities understand the urgency and severity of cyberattacks and water systems are ready to address these serious threats to our nation’s public health.”