America’s drinking water is facing attack, with links back to China, Russia and Iran
Houston Chronicle/hearst Newspapers Via Getty Images | Hearst Newspapers | Getty Images
The City of Wichita recently had an experience that’s become all too common — its water system was hacked. The cyberattack, which targeted water metering, billing and payment processing, followed the targeting of water utilities across the U.S. in recent years.
In going after America’s water, hackers aren’t doing anything special. Despite rising fears of AI use in cyber threats, the go-to criminal way into systems remains preying on human foibles, be it via phishing, social engineering, or a system still running on a default password — “old school” cyberattacks, according to Ryan Witt, vice president of cybersecurity firm Proofpoint.
The rising cybercrime wave targeting key infrastructure led the Environmental Protection Agency to issue an enforcement alert warning that 70% of water systems it inspected do not fully comply with requirements in the Safe Drinking Water Act. Without quantifying an exact number, the EPA said some have “alarming cybersecurity vulnerabilities” — default passwords that have not been updated, vulnerable single login setups, and former employees who retained systems access.
While the methods may be simple, an attack last year by an Iranian-backed activist group against 12 water utilities in the U.S. reinforced how purposeful “an attacker’s mindset” can be, according to Witt. The targeted utilities all contained equipment that was Israeli-made.
FBI, NSA, CISA all express concern
In February, the FBI warned Congress that Chinese hackers have burrowed deep into the United States’ cyber infrastructure in an attempt to cause damage, targeting water treatment plans, the electrical grid, transportation systems and other critical infrastructure. A Russian-linked hack in January of a water filtration plant in a small Texas town, Muleshoe — located near a U.S. Air Force base — caused a water tank to overflow. “Water is among the least mature in terms of security,” Adam Isles, head of cybersecurity practice for Chertoff Group, recently told CNBC.
Psychological impact on the population is also a strategic aim, seen not only in targeting of water assets but the Colonial Pipeline hack that made national headlines in 2021, and in the words of the federal Cybersecurity and Infrastructure Security Agency, featured “snaking lines of cars at gas stations across the eastern seaboard and panicked Americans filling bags with fuel, fearful of not being able to get to work or get their kids to school.”
Attacks on U.S. water utilities’ IT systems can have a similar psychological impact, and even if the attacks don’t directly interfere with the operations of the utility, still lessen public trust in water supply. No hack to date has shut off the water to a population, but that’s the bigger worry, said Stuart Madnick, an MIT professor of engineering systems and co-founder of Cybersecurity at MIT Sloan.
Meddling with a water supply through attacks targeting IT (informational technology), like Wichita’s system, is minor in comparison to a successful attack on the OT (operating technology) that controls water plants. That is a massive risk, Madnick said, and the threat of it happening is not zero.
“We have demonstrated in our lab how operations, such as a water plant, could be shut down not just for hours or days, but for weeks. It is definitely technically possible,” he said.
A recent letter sent by EPA Administrator Michael Regan and National Security Advisor Jake Sullivan to the nations’ governors detailed the urgency of the threat. But Madnick is wary of the government’s ability to act quickly or robustly enough to prevent such an occurrence. Budgets, outdated infrastructure, and reluctance to move on an issue that may seem both vital and daunting suggest that the fixes may indeed not come quickly enough. “It has not happened yet, and serious action to prevent ‘likely’ will not happen, until after it has happened,” he said.
Outdated water utility technology
Like any modern system, water utilities rely on technology for monitoring, for operations, and for customer communication. The technology creates vulnerabilities — for providers and users — so the need for enhanced security measures is acute. “The community risk from cyberattacks includes an attacker gaining control of the operations of a system to damage infrastructure, disrupt the availability or flow of water, or altering the chemical levels, which could allow untreated wastewater to be discharged into a waterway or contaminate drinking water provided to a community,” said an EPA spokesman.
Witt says there are some initial steps to take in improving the cyber hygiene of dated systems. “Improving password strength, reducing exposure to public-facing internet, and the need for cybersecurity awareness training,” would go a long way to shoring up defenses, he said. Another potential fix is the deployment of what are called air-gapped systems that separate supervisory and control systems from other networks. Since the easiest way into these systems is to obtain credentials and then exploit the system, “A systems admin should not be able to access office systems such as email and be able to operate a control panel of a water system from the same laptop,” Witt said.
For the most part, attacks that have occurred have been preventable, according to the EPA. “Systems were victimized by destructive and costly cyberattacks because they failed to adopt basic cyber resiliency practices,” the EPA spokesman said. “All drinking water and wastewater systems are at risk — large and small, urban and rural,” he said.
While it has not been a tool needed to date in these water utility attacks, AI is coming alongside the concerted cyber efforts of geopolitical rivals. “Rapid advances in artificial intelligence are giving cyberthreat actors more sophisticated tactics, techniques, and procedures to penetrate operational technology that controls critical infrastructure facilities,” the EPA spokesman said. “These attacks have been linked to a variety of types of malicious actors, including hackers working on behalf of or in support of other nations who could use disruptions to U.S. critical infrastructure to their strategic advantage.”
Jaque Silva | Nurphoto | Getty Images
Oracle’s Federal Electronic Health Record experienced a nation-wide outage on Tuesday, the Department of Veterans Affairs confirmed to CNBC.
The agency said “all users” of the company’s Federal EHR, including the VA, the Department of Defense, the U.S. Coast Guard and the National Oceanic and Atmospheric Administration, were impacted. Six VA medical centers, 26 community clinics, and remote VA sites experienced disruptions, the agency said.
“Affected VA medical facilities followed standard contingency procedures during the outage to ensure continuity of care for Veterans,” a VA spokesperson said in a statement Thursday.
An electronic health record, or an EHR, is a digital version of a patient’s medical history that’s updated by doctors and nurses. It’s crucial software within the U.S. health-care system, and outages can cause serious disruptions to patient care.
Oracle is one of the largest EHR vendors thanks to it’s $28 billion acquisition of the medical records giant Cerner in 2022.
The company’s Federal EHR initially started experiencing issues at around 8:37 a.m. Eastern on Tuesday, the VA said. Users reported that the software froze and they were unable to access applications. Access was restored and cleared by 2:05 p.m. Eastern that day after Oracle restarted the system.
Oracle is carrying out an investigation to determine what caused the outage, the VA said. Oracle did not immediately respond to CNBC’s request for comment.
The outage marks Oracle’s latest stumble in a thorny, years-long EHR rollout with the VA, which has been marred by patient safety concerns. The agency launched a strategic review of Cerner in 2021, before Oracle’s acquisition, and it temporarily paused deployment of the software in 2023.
Four VA facilities in Michigan are slated to deploy Oracle’s Federal EHR in 2026.
In October, Oracle unveiled a brand-new EHR equipped with fresh cloud and artificial intelligence capabilities. The early adopter program for the software begins this year, though it’s not clear if the VA has plans to utilize it.
Oracle is slated to report third-quarter fiscal 2025 earnings on Monday.
Watch: Oracle CEO Safra Catz: Being number one is very important
Broadcom CEO Hock Tan.
Lucas Jackson | Reuters
Broadcom reported first-quarter earnings on Thursday that topped analysts’ expectations, and the chipmaker offered strong guidance for the current quarter. The stock jumped 16% in extended trading.
Here’s how the company did versus LSEG consensus estimates:
- Earnings per share: $1.60 adjusted vs. $1.49 expected
- Revenue: $14.92 billion vs. $14.61 billion expected
Broadcom said it expects about $14.9 billion in second-quarter revenue, higher than the $14.76 billion forecast by Wall Street analysts. Revenue in the last quarter rose 25% from $11.96 billion a year earlier.
The company said net income increased to $5.5 billion, or $1.14 per share, from $1.33 billion, or 28 cents per share, in the same period last year.
Broadcom’s artificial intelligence business is at the center of the company’s recent boom, which saw its stock price more than double last year. The company is one of the primary data center infrastructure vendors for AI, working both on Google’s custom AI chips as well as providing essential components for networking thousands of other chips together to develop advanced AI software.
Prior to the after-hours pop, the stock was down about 23% so far in 2025, as investors rotate out of risk partly due to concern about President Donald Trump’s tariffs.
Broadcom said it recorded $4.1 billion in AI revenue during the first quarter, which is 77% higher on a year-over-year basis. Those sales are reported as part of Broadcom’s semiconductor solutions business, which grew 11% on an annual basis to $8.21 billion during the quarter.
Broadcom CEO Hock Tan said in a statement that the company expects “continued strength in AI semiconductor revenue,” reaching a projected $4.4 billion in the second quarter.
In December, Broadcom said it was developing custom AI chips with three large cloud customers. Tan said on Thursday that in addition to those customers, it had “deeply engaged” with two other hyperscalers, and are working with four other potential customers to develop their own custom AI chips.
Tan said that Broadcom closely chooses partners for developing custom AI chips who can deploy the resulting product in large quantities. “To put it bluntly, we don’t do it for startups,” Tan said.
The other major part of Broadcom’s revenue comes from its infrastructure software division, which includes software from the company’s acquisition of VMware in the fourth fiscal quarter of 2023. Broadcom said it saw $6.7 billion in software sales during the quarter, a 47% increase on an annual basis.
WATCH: Chip stocks see strong performance punished by markets
Antonio Neri, CEO of Hewlett Packard Enterprise, speaks during an interview with CNBC on the floor of the New York Stock Exchange (NYSE) in New York City, October 20, 2023.
Brendan McDermid | Reuters
Hewlett Packard Enterprise shares slid 19% in extended trading on Thursday as the data center equipment maker issued quarterly and full-year guidance that came in below consensus.
Here’s how the company did in the fiscal first quarter in comparison with LSEG consensus:
- Earnings per share: 49 cents adjusted vs. 49 cents expected
- Revenue: $7.85 billion vs. $7.82 billion expected
HPE’s revenue rose 16% year over year in the quarter ending on Jan. 31, according to a statement. The company was left with profit of $598 million, or 44 cents per share, up from $387 million, or 29 cents per share, in the same quarter a year earlier. The adjusted earnings per share excludes stock-based compensation.
“We could have executed better,” CEO Antonio Neri said on a conference call with analysts. The company had higher than normal inventory for artificial intelligence servers because of a shift to next-generation Blackwell graphics processing units from Nvidia.
The backlog for AI systems rose 29% quarter over quarter to $3.1 billion. Total server revenue totaled $4.29 billion.
HPE dealt with extensive discounting in the market while selling traditional servers during the quarter, finance chief Marie Myers said. As the quarter progressed, HPE moved to limit travel and discretionary spending, she said.
“We expect pricing adjustments may negatively impact top-line growth in the near term,” Myers said.
The company said it would implement a cost-cutting program involving layoffs over the next 18 months that will lead to $350 million in gross savings by the 2027 fiscal year. Around 2,500 employees will be affected, a spokesperson said, representing about 5% of the workforce when also factoring in expected attrition. At the end of October, HPE employed 61,000 people, according to its most recent annual report.
In January, the U.S. Justice Department filed in a federal district court to stop HPE from acquiring Juniper Networks. HPE announced the proposed $14 billion deal in January 2024. The court expects a trial to begin in July, according to the statement. The deal should close by October 2025, HPE said. In December, the company had said the transaction would be done in early 2025.
HPE called for 28 cents to 34 cents in adjusted earnings per share for the fiscal second quarter, with revenue coming in between $7.2 billion and $7.6 billion. Analysts surveyed by LSEG had looked for 50 cents per share on $7.93 billion in revenue.
For the 2025 fiscal year, HPE sees $1.70 to $1.90 in adjusted earnings per share. Analysts polled by LSEG had predicted $2.13 per share.
HPE expects to update its prices to reflect higher expenses from U.S. tariffs, Neri said, adding that he has not perceived any business deterioration from President Donald Trump’s so-called Department of Government Efficiency.
As of Thursday’s close, HPE shares were up about 2% so far in 2025, while the S&P 500 index was down 2%.
WATCH: HPE shares fall more than 10% after mixed earnings, layoff plans
-
Sports2 years ago‘Storybook stuff’: Inside the night Bryce Harper sent the Phillies to the World Series
-
Sports11 months agoStory injured on diving stop, exits Red Sox game
-
Sports1 year agoGame 1 of WS least-watched in recorded history
-
Sports2 years agoMLB Rank 2023: Ranking baseball’s top 100 players
-
Sports3 years ago
Team Europe easily wins 4th straight Laver Cup
-
Environment2 years agoJapan and South Korea have a lot at stake in a free and open South China Sea
-
Environment2 years agoGame-changing Lectric XPedition launched as affordable electric cargo bike
-
Business2 years agoBank of England’s extraordinary response to government policy is almost unthinkable | Ed Conway