My grandmother used to say, “Well, I hate to tell you I told you so, but … [shakes head, sighs].”

Late July gave the water industry its closest thing to a live-fire drill. Attackers reached programmable logic controllers at 30-plus community water systems in Minnesota over one weekend, touching utilities in at least seven states by the time the FBI, EPA, and CISA finished counting.

Operators lost visibility and control. Passwords were changed out from under them. Some systems switched to manual control, and several issued precautionary boil-water notices. No contamination was confirmed, and no community lost service for long. But make no mistake. We got lucky.

What should unsettle everyone is the apparent lack of sophistication of the intrusions, as if a door was just left open. Investigators point to exposure as the culprit. More specifically, programmable logic controllers reachable from the public internet, often behind weak credentials or undocumented cellular modems added by a vendor or integrator.

While there is relief that chaos did not ensue, this crisis highlights how utility leaders must steer toward segmentation, credential hygiene, and getting OT off the open internet to safeguard themselves and public water systems. The real indictment: we’ve been telling each other this for years. How often have experts said, “It’s not a matter of if, but when?” Well, that “when” is now.

Utilities are short on resources, especially small and mid-size ones running lean, where a full-time OT security is a luxury and where cybersecurity competes with aging infrastructure for the same constrained dollars.

I’ll say something that may sound paranoid, but this is my letter. This feels less like a nuisance, and more like a test run. How long did it take to stop? How thin was staff stretched? What could a sharper attacker do next?

The water came out safe this time. Hoping next time is the same is not a strategy.

-        Mandy Crispin, WaterWorld Editor-in-Chief

Read the September October digital issue today!