What would you do if your toilet stopped flushing? What if the taps ran dry and you were unable to access safe drinking water for days or even weeks?

You likely have a plan for a power outage, but what about the long-term unavailability of clean water or sewage services? This is the scenario that keeps Lesley Carhart and their colleagues at risk management firm Dragos Inc. up at night.

“Not having sewage that works is a big deal,” says Carhart, who is technical director of incident response at Dragos. “We’re not used to seeing that in the United States. Not having clean water to drink is not something we’re used to in most of the United States and Canada.”

Water systems limited defense, monitoring, and detection abilities, along with the potential to make a big impact when struck, make them a “juicy target when you have that overarching goal—which a lot of these adversary groups do—of having a big negative impact and psychological impact on an opposing country,” Carhart adds.

It’s hardly unheard of. Threat actors struck water treatment plants using cyberattacks in recent years, including when a hacking group tied to Russian state actors infiltrated a Texas water facility in January 2024, causing a system malfunction and forcing a water tank to overflow. The same group took credit for an attack at a wastewater treatment facility in Indiana in April. In late 2023, an Iranian-linked group targeted multiple organizations that used Israeli-designed equipment, including a Pennsylvania town’s water provider, forcing it to switch from a remote pump to manual operations.

Electric grids and major utility providers have increased their resources and cybersecurity defenses in recent years, but most U.S. water and wastewater utilities are municipal. As such, they are likely working out of nondescript office buildings with just a few computers and IT professionals controlling systems that supply water for cities and towns, Carhart says. This lack of robust resources and support puts these organizations at risk.

The U.S. Environmental Protection Agency (EPA) warned in May 2024 that water systems are being targeted by cyber-attackers. The agency also said that 70 percent of utilities inspected by federal officials in the past year violated standards meant to prevent breaches, such as failing to change default passwords or revoke system access for former employees.

“Implementing basic cyber hygiene practices can help your utility prevent, detect, respond to, and recover from cyber incidents,” the EPA said. “Because water utilities often rely on computer software to operate their treatment plants and distribution systems, protecting information technology and process control systems from cyberattacks is vital. Small water systems are not immune from cyberattacks.”

The interconnectivity between information technology (IT) and operational technology (OT) systems makes a holistic risk management approach essential, says Roya Gordon, executive industry consultant for OT Cyber at Hexagon’s asset lifecycle intelligence division. Although recent high-profile attacks have targeted OT infrastructure—such as the systems that add chemicals to treat drinking water—she warns that organizations can’t abandon IT security to focus on OT because adversaries will use IT weak links (including poor credentialing or cyber hygiene) to access OT systems.

“We’re now in a paradigm shift,” Gordon says. “Before, we saw there being security layered on top of these legacy systems. You can’t just rip and replace and upgrade systems in OT environments because it’s a live environment. You can’t afford downtime.”

So, instead of replacing insecure systems, operators would use workarounds that layer security systems on top by adding firewalls, threat intelligence solutions, and monitoring.

The industry is shifting toward security-by-design, but it’s slow going because of the longevity of OT. Systems are designed to last for decades, meaning it could easily be 40 years before a less-secure system can feasibly be replaced, Gordon explains. In addition, downtime in utilities, even just to change a small configuration, could result in service interruptions or even break other, older OT systems. A 2024 SecurityWeek report found that maintenance is the primary source of OT security incidents. So, operators must proceed with caution when upgrading systems, making investments in both IT and site security to protect OT even more vital.

Utilities have long relied on a method of “security by obscurity,” hiding OT procedures and systems behind layers of other systems and tools, Carhart says. Sifting through all of that is a long-term, expensive investment for an attacker looking for a way in.

“At the most fundamental level, adversaries will use the least amount of resources and effort to reliably accomplish their goals,” Carhart explains. “If you want to take out power to some geographic area, if you are there locally, it’s probably easier to take a paint can and throw it on a transformer than learn how to infiltrate a system over a long period of time. That’s a hefty investment that takes a lot of time, a lot of people, and a lot of expertise. If you have physical access to that thing and you’re not going to get caught, you’re going to take a paint can, throw it on a transformer, and cause a big disruption. If you’re across the planet and you can’t do that, well, the most efficient, effective way to do that same type of thing might be to do this reconnaissance, learn about an environment, and do your best job in doing a disruptive attack.”