2 water systems in Cape May County hit in cyberattack targeting multiple states

Published on Aug. 5 | Updated on Aug. 7

PHILADELPHIA (KYW Newsradio) — Iranian hackers could be behind cyberattacks on two water systems in Cape May County, New Jersey.

According to NBC10, the two affected utilities were in Cape May and Woodbine. Officials said the City of Cape May Water and Sewer Department and the Borough of Woodbine Water Department recently identified and responded to cybersecurity incidents that affected their computer networks.

New Jersey’s cybersecurity chief said the attacks temporarily limited the utilities’ ability to monitor their systems. In both cases, staff switched to manual operations; fortunately, there were no disruptions to service.

Cape May City Manager Paul Dietrich said they activated their emergency procedures, and the incident never interfered with the drinking water.

“[The hackers] just went in and said, ‘Hey, hi, we’re here,’ and left,” he said. “There’s no ransomware. They simply came in and just changed the IP address of our system so that we couldn’t gain access to it. They made no other controls. They didn’t turn pumps on and off, or change any of the operating parameters of our system.”

Officials also said the hackers did not access any customer data.

Cybersecurity officials have not confirmed Iran’s involvement, but the FBI has warned that Iranian hackers are targeting water and sewer systems.

Cybersecurity vulnerabilities

The feds are investigating the attacks on utilities in New Jersey and across the country. According to ABC News, at least a dozen states are dealing with cyber intrusions targeting water and wastewater utilities, most notably in Michigan and Minnesota. That number is up from last week, when the FBI said at least seven states had been hit.

Rob D’Ovidio, a professor specializing in cybercrime at Drexel University, said these attacks are exposing vulnerabilities in American water systems.

“The weak link here is this public internet-facing access to control systems,” he said. “There’s no reason why we should allow foreign IP address ranges to be able to even access these systems.”

The FBI is urging utilities to disconnect from the internet wherever possible and become familiar with operating manually in case automated systems are compromised.

D’Ovidio believes American utilities must update the systems currently in place.

“I can’t emphasize enough the need to modernize our infrastructure,” he said. “We need to trash the equipment that is older, that’s not receiving updates anymore, that isn’t updateable anymore.

“We need to enforce strong, unique credentials. We need to segment these networks and restrict access.”

The FBI said if a water system is tampered with, it could create flooding or pressure loss, which could cause untreated groundwater to seep into pipes.