Foreign cyber attacks are getting countered by U.S. intelligence, AI, and even university students. (WCHS)
CHARLESTON, W.Va. (WCHS) —Water access for millions of Americans may be in jeopardy as foreign hackers, including Iran-linked groups, target critical infrastructure in at least a dozen states.
Rural water systems nationwide are increasingly under attack from cybercriminals. Experts warn that the most dangerous scenarios involve stealthy intrusions where unauthorized bad actors manipulate systems without detection, potentially leading to total service disruptions or severe sewage backups.
John McLain is the director of cyber resiliency at the Georgia Cyber Center, with decades of experience at the front lines of cyber warfare. He emphasizes that cybersecurity professionals must shift their perspective.
“You have to stop thinking about the cybersecurity for the water supply in particular as protecting computers,” McLain said. “You’ve got to think of it as protecting the delivery of clean water.”
According to the FBI, recent attacks across at least seven states shared common vulnerabilities: default passwords on remote access servers. These weak points leave municipal systems exposed to hostile intrusions.
In West Virginia, where water treatment processes can take hours to safely process and deliver water from natural sources like local creeks, remote management adds another layer of complexity and potential exposure.
To address these growing threats, lawmakers on Capitol Hill are advancing the Water Resiliency Bill.
U.S. Sen. Shelley Moore Capito, R-W.Va., noted that additional resources are being directed toward bolstering cyber protections, particularly for smaller municipal systems with limited operational capacity.
Experts say securing these networks begins with robust monitoring, managed access and multi-factor authentication, which significantly raises the cost and effort required for malicious efforts to breach a system.
“When you’re properly protected, the juice that goes behind actually getting to the squeeze is actually pretty high,” McLain said.
While much of the defense strategy relies on automated systems and artificial intelligence, institutions such as Augusta University are also incorporating students into the defense process. By training students in advanced cyber operations, the center aims to leverage emerging talent to help safeguard critical infrastructure before future attacks occur.
