MILWAUKEE — Federal and Wisconsin officials are warning water utilities to secure critical infrastructure systems after cyber incidents in neighboring Minnesota disrupted water operations and raised concerns about vulnerabilities in utility control systems.
PREVIOUS COVERAGE |Cybersecurity expert explains cyber threats facing Wisconsin water systems
In a joint public warning issued Thursday, the FBI and Environmental Protection Agency said malicious cyber actors have targeted internet-facing Programmable Logic Controllers used by water utilities in at least seven states. Federal officials said some incidents led to operational disruptions, including pressure loss and utilities switching to manual operations.
The Cybersecurity and Infrastructure Security Agency, or CISA, also warned of a “significant increase” in cyber actors targeting PLCs used by water and wastewater systems.
Holden said internet-exposed industrial control systems remain a concern.
‘They are just sitting open on the internet, exposing their internal configurations,’ Holden said.
Federal officials are urging utilities to remove internet-exposed operational technology systems, strengthen passwords and review remote access controls.
Despite the warnings, Wisconsin officials say there are currently no confirmed compromises involving Wisconsin water systems.
“The DNR will continue to coordinate messages to systems as warranted as further information becomes available,” a DNR spokesperson said in a statement to TMJ4 News.
Milwaukee Water Works told TMJ4 it is aware of heightened cybersecurity concerns and is actively monitoring its systems. The utility said it remains confident its systems are secure.
The Milwaukee Metropolitan Sewerage District also said it is closely monitoring its systems and remains in regular contact with Homeland Security.
Federal and state advisories specifically reference Allen-Bradley PLCs made by Milwaukee-based Rockwell Automation.
In a statement to TMJ4, Rockwell Automation said it is working with customers, partners and government agencies regarding reports of unauthorized cyber activity and disruptions at some utilities.
“Rockwell Automation takes the security of its products and solutions seriously,” the company said.
Holden said internet-exposed industrial control systems remain a concern.
“These are internal components, and our water supply should be handled on closed circuits and really segregated controls away from the internet,” Holden said.
Federal officials are urging utilities to remove internet-exposed operational technology systems, strengthen passwords and review remote access controls.
Officials stressed there is currently no indication Wisconsin drinking water has been impacted.
It’s about time to watch on your time. Stream local news and weather 24/7 by searching for “TMJ4” on your device.
Available for download on Roku, Apple TV, Amazon Fire TV, and more.