Over the past few decades, water and wastewater utilities have become increasingly reliant on computer networks. That has improved efficiency and helped control costs, but it has also exposed utilities to a growing threat: cyberattacks.
Of particular concern is the potential for hackers to interfere with equipment that controls chemical levels and water flows, with potentially serious consequences for public health, the environment and utilities’ finances.
The threat is not merely hypothetical.
In 2024, Tipton Municipal Utilities made national headlines after reporting that a small wastewater facility had been targeted in an attack by a Russia-linked group.
Then this summer, an Iran-linked group claimed responsibility for cyberattacks targeting dozens of water utilities across at least 12 states.
Around that time, some Indiana utilities reported outside activity on their networks, said Travis Goodwin, who oversees cybersecurity issues for drinking water utilities at the Indiana Department of Environmental Management.
The activity caused no operational disruptions, Goodwin said, and it was not necessarily connected to the group linked to Iran.
“It could have been traffic from a federal [agency] that was looking for exposed devices,” Goodwin said. “So it was different in that way. No attempt was made to take control of a device. … [Indiana utilities] never noticed any nefarious activity, just that maybe a device was touched by somebody externally.”
Although the reported incidents caused little, if any, disruption to Indiana water services, officials increasingly see cybersecurity as a long-term challenge.
In 2025, state lawmakers required many water and wastewater utilities to conduct annual cybersecurity evaluations and report incidents. This summer, Gov. Mike Braun’s administration also established an Office of Cybersecurity.
But the new requirements highlight a central challenge: Smaller utilities that may have the fewest resources to defend against cyber threats are now being asked to do more to assess those risks.
Larger utilities — such as Indianapolis-based Citizens Energy Group and Indiana American Water, a division of New Jersey-based American Water Co. — can afford dedicated cybersecurity staff and equipment. Smaller utilities often operate with far fewer resources, said Chetrice Romero, senior cybersecurity adviser at Indianapolis-based Ice Miller LLP.
“About 80% of water, wastewater infrastructure is run by local governments,” she said. “So that presents a challenge in itself” because local governments don’t have a lot of money and resources.
Meanwhile, the threats themselves are becoming more sophisticated.
Cyber threats have grown increasingly complex over the past five years, and artificial intelligence is expanding the capabilities of attackers, said Scott Miller, director of information security at Citizens Energy Group. But the technology is also helping utilities strengthen their defenses, he said.
“Microsoft, for example, used to release less than 100 or so [vulnerabilities] per month that they would patch. … Last month was 1,400 vulnerabilities that Microsoft is patching,” Miller said. “You see this across industries. This isn’t unique to utilities necessarily.”
Multiple front doors
Cyberattacks on water and wastewater utilities increasingly target not only information technology used for business operations but also operational technology that controls equipment.
Of particular concern are programmable logic controllers, or PLCs — small computers that use real-time data to control equipment involved in adjusting chemical levels and water flows.
Miller said the attacks targeted PLCs. He said the industry has been focused on “security and locking those devices down.”
Another risk comes from monitoring systems, said Joe Beckman, principal investigator with Cybertrack, a joint cybersecurity program of Purdue University and Indiana University that provides assistance to municipalities.
“If the data coming from those devices is corrupted, it can tell you things that aren’t necessarily happening and react incorrectly,” he said. “And so the integrity of this data becomes important in ways that we wouldn’t have thought of 10 years ago.”
These challenges prompted changes in the way Citizens maintains its computer system at the plants, Miller said.
“Historically, [computer networks] would be installed when a plant was built — for example, 20, 30 years ago — and then those systems would be left alone, the plant was running fine, computers were controlling the plant and operating just fine,” Miller said. “I think what you’ve seen in the last 10, 15 years is, that approach no longer works.”
Citizens also isolates its operational technology from the internet, a practice federal officials have long recommended, Miller said.
But isolating operational systems is not enough on its own. Utilities need multiple layers of protection, he said.
“It’s kind of like multiple locks on a door, or multiple front doors to your house,” Miller said. “If somebody broke through the first front door, they’ve got additional doors that they would need to get through to get anywhere.”
AI raises the stakes
Artificial intelligence is accelerating both cyberattacks and defenses, creating “a bit of an AI arms race,” Miller said.
“We’re able to use AI agents to comb through a lot of data quicker than really any human ever could,” he said. “And so I think we’re leveraging it from a cyber-defense perspective. But again, it’s being used on the other side just as fast as we’re using it for defense.”
But direct attacks on technology are just part of the threat AI poses, Romero said. It has also made phishing, or social engineering schemes, much more effective.
Romero said such deception has historically been a major source of cyberattacks.
“AI can create, in seconds, dossiers of executives or leadership or the mayor … and you can get in using that psychological manipulation through an email for somebody,” she said.
Beckman said basic cybersecurity measures can still significantly reduce risk. Cybercriminals tend to exploit existing vulnerabilities rather than seek more complicated ways into systems, he said.
He compared it to a basketball game: “If I’ve got a huge guy in the lane that I can throw the ball to and he can dunk it, and that’s two points for me every trip down, I’m going to keep doing that until you can stop it. And so we’re kind of in that same position in cybersecurity where, if you want me to have to attack you differently, then you’ll have to shore up and close the gaps that I’m using today.”
The cost of protection
The consequences of a successful attack could extend well beyond a utility’s computer systems.
“If you think about it in terms of the power outage and flooding caused by the storms that recently came through the state in August, if you think about that as if it were a cyberattack, that’s the kind of pain we’re talking about for people,” Beckman said.
Cybertrack began working with organizations that rely on operational technology, including water and wastewater utilities, in early 2025. The expansion reflects growing concern about cybersecurity risks to essential infrastructure.
That was also the year Indiana lawmakers passed Senate Enrolled Act 459.
The law requires covered water and wastewater utilities using computerized systems to conduct annual cybersecurity evaluations, designate a state cybersecurity contact and report cybersecurity incidents to the state. It covers utilities serving at least 500 people, along with certain public and semipublic treatment works.
Former state Sen. Andy Zay, a co-author of the legislation, said lawmakers had already increased penalties for cyberattacks. But he said criminal penalties have limited deterrent value when threats originate overseas. Zay later served on the Indiana Utility Regulatory Commission.
“It really was creating the awareness through mid and smaller utilities that not only is it a threat to our largest utilities, but a threat through really all of our infrastructure modems, and we wanted to just elevate the conversation on that,” Zay said.
Drinking water utilities serving at least 3,300 people were already subject to some cybersecurity assessment requirements, said Goodwin of IDEM. Indiana’s law expands both the number of utilities covered and how frequently they must conduct evaluations.
For Tipton Municipal Utilities, the utility that experienced the cybersecurity event in 2024, the impact of SEA 459 has been minimal because the organization was already conducting cybersecurity evaluations, said General Manager Jim Ankrum.
Tipton does not have its own cybersecurity department but contracts with an outside vendor for some security services. Ankrum said the arrangement has reduced the utility’s exposure to threats at an initial cost of $25,000, plus $5,000 annually. The spending represents less than 1% of the utility’s budget, he said in an email.
Ankrum noted that Tipton might be uniquely situated in that it also manages electric service locally, which adds another level of sophistication to its operations. He also noted the utility has continually invested in water and wastewater technology through the years.
And while Tipton Municipal Utilities, which serves a city of about 5,200 people, is small, many other utilities in the state are even smaller. These are likely to be the most cash-strapped operations when it comes to addressing the challenge.
Requiring evaluations is important, but there is often a need for new equipment, too, Beckman said.
“If that system [costs] a quarter of a million, and the devices are correspondingly expensive, how often are you going to replace them?” he said. “If they’re still working, you’re not going to want to replace them. They’re serving their function.”
Another challenge is how varied these systems are in design, Romero noted.
“If you’ve seen one water utility or wastewater utility here in Indiana, you’ve seen one,” she said. “Every one is different.”
And upgrades often must be approved by officials making tough budget decisions for many local government projects and priorities, Romero said.
“They don’t want to raise rates. It becomes political, so they don’t [raise rates] or they don’t do it enough to cover the increasing costs of the technology they really do need [in order] to protect their infrastructure better,” she said.
In addition, the sector is less regulated when it comes to cybersecurity issues than other utilities and critical infrastructure, such as power generation and distribution, she said.
If or when regulations increase, she said, local governments will need help with funding for equipment upgrades.
Goodwin said smaller utilities could benefit from more direct state funding to address cybersecurity needs, though any such assistance would be up to lawmakers. “But that would have to become a question for the Legislature,” he said.
——————————————————-
Click Here For The Original Source.
