America’s drinking water is facing attack, with links back to China, Russia and Iran
Houston Chronicle/hearst Newspapers Via Getty Images | Hearst Newspapers | Getty Images
The City of Wichita recently had an experience that’s become all too common — its water system was hacked. The cyberattack, which targeted water metering, billing and payment processing, followed the targeting of water utilities across the U.S. in recent years.
In going after America’s water, hackers aren’t doing anything special. Despite rising fears of AI use in cyber threats, the go-to criminal way into systems remains preying on human foibles, be it via phishing, social engineering, or a system still running on a default password — “old school” cyberattacks, according to Ryan Witt, vice president of cybersecurity firm Proofpoint.
The rising cybercrime wave targeting key infrastructure led the Environmental Protection Agency to issue an enforcement alert warning that 70% of water systems it inspected do not fully comply with requirements in the Safe Drinking Water Act. Without quantifying an exact number, the EPA said some have “alarming cybersecurity vulnerabilities” — default passwords that have not been updated, vulnerable single login setups, and former employees who retained systems access.
While the methods may be simple, an attack last year by an Iranian-backed activist group against 12 water utilities in the U.S. reinforced how purposeful “an attacker’s mindset” can be, according to Witt. The targeted utilities all contained equipment that was Israeli-made.
FBI, NSA, CISA all express concern
In February, the FBI warned Congress that Chinese hackers have burrowed deep into the United States’ cyber infrastructure in an attempt to cause damage, targeting water treatment plans, the electrical grid, transportation systems and other critical infrastructure. A Russian-linked hack in January of a water filtration plant in a small Texas town, Muleshoe — located near a U.S. Air Force base — caused a water tank to overflow. “Water is among the least mature in terms of security,” Adam Isles, head of cybersecurity practice for Chertoff Group, recently told CNBC.
Psychological impact on the population is also a strategic aim, seen not only in targeting of water assets but the Colonial Pipeline hack that made national headlines in 2021, and in the words of the federal Cybersecurity and Infrastructure Security Agency, featured “snaking lines of cars at gas stations across the eastern seaboard and panicked Americans filling bags with fuel, fearful of not being able to get to work or get their kids to school.”
Attacks on U.S. water utilities’ IT systems can have a similar psychological impact, and even if the attacks don’t directly interfere with the operations of the utility, still lessen public trust in water supply. No hack to date has shut off the water to a population, but that’s the bigger worry, said Stuart Madnick, an MIT professor of engineering systems and co-founder of Cybersecurity at MIT Sloan.
Meddling with a water supply through attacks targeting IT (informational technology), like Wichita’s system, is minor in comparison to a successful attack on the OT (operating technology) that controls water plants. That is a massive risk, Madnick said, and the threat of it happening is not zero.
“We have demonstrated in our lab how operations, such as a water plant, could be shut down not just for hours or days, but for weeks. It is definitely technically possible,” he said.
A recent letter sent by EPA Administrator Michael Regan and National Security Advisor Jake Sullivan to the nations’ governors detailed the urgency of the threat. But Madnick is wary of the government’s ability to act quickly or robustly enough to prevent such an occurrence. Budgets, outdated infrastructure, and reluctance to move on an issue that may seem both vital and daunting suggest that the fixes may indeed not come quickly enough. “It has not happened yet, and serious action to prevent ‘likely’ will not happen, until after it has happened,” he said.
Outdated water utility technology
Like any modern system, water utilities rely on technology for monitoring, for operations, and for customer communication. The technology creates vulnerabilities — for providers and users — so the need for enhanced security measures is acute. “The community risk from cyberattacks includes an attacker gaining control of the operations of a system to damage infrastructure, disrupt the availability or flow of water, or altering the chemical levels, which could allow untreated wastewater to be discharged into a waterway or contaminate drinking water provided to a community,” said an EPA spokesman.
Witt says there are some initial steps to take in improving the cyber hygiene of dated systems. “Improving password strength, reducing exposure to public-facing internet, and the need for cybersecurity awareness training,” would go a long way to shoring up defenses, he said. Another potential fix is the deployment of what are called air-gapped systems that separate supervisory and control systems from other networks. Since the easiest way into these systems is to obtain credentials and then exploit the system, “A systems admin should not be able to access office systems such as email and be able to operate a control panel of a water system from the same laptop,” Witt said.
For the most part, attacks that have occurred have been preventable, according to the EPA. “Systems were victimized by destructive and costly cyberattacks because they failed to adopt basic cyber resiliency practices,” the EPA spokesman said. “All drinking water and wastewater systems are at risk — large and small, urban and rural,” he said.
While it has not been a tool needed to date in these water utility attacks, AI is coming alongside the concerted cyber efforts of geopolitical rivals. “Rapid advances in artificial intelligence are giving cyberthreat actors more sophisticated tactics, techniques, and procedures to penetrate operational technology that controls critical infrastructure facilities,” the EPA spokesman said. “These attacks have been linked to a variety of types of malicious actors, including hackers working on behalf of or in support of other nations who could use disruptions to U.S. critical infrastructure to their strategic advantage.”
Chuck Robbins, chief executive officer of Cisco, participates in a Bloomberg interview at the World Economic Forum in Davos, Switzerland, on Jan. 17, 2024.
Stefan Wermuth | Bloomberg | Getty Images
Few companies were as hot in early 2000 as Cisco, whose networking equipment served as the backbone of the internet boom.
On Wednesday, Cisco’s stock surpassed its dot-com peak for the first time. The shares rose almost 1% to $80.25, topping their prior split-adjusted record or $80.06 reached on March 27, 2000. That’s the same day that Cisco passed Microsoft to become the most valuable publicly traded company in the world.
Back then, investors saw Cisco as a way to bet on the growth of the web, as companies that wanted to get online relied upon the hardware maker’s switches and routers. But following a half-decade boom, the dot-com bubble burst just after Cisco reached its zenith, a collapse that wiped out more than three-quarters of the Nasdaq’s value by October 2002.
While the market swoon eliminated scores of internet highflyers, Cisco survived the upheaval. Eventually it started to grow and expand, diversifying through a series of acquisitions like set-top box maker Scientific- Atlanta in 2006, followed by software companies including Webex, AppDynamics, Duo and Splunk.
With its gains on Wednesday, Cisco’s market cap sits at $317 billion, making it only the 13th most valuable U.S. tech company. In recent years, the stock has badly trailed tech’s megacaps, which have been at the center of the new boom surrounding artificial intelligence.
The AI market has reached a level of euphoria that many analysts have compared to the dot-com era. Instead of Cisco, the modern infrastructure winner is Nvidia, whose AI chips are at the heart of model development and are relied up by the other major tech companies that are all building out AI-focused data centers. Nvidia has a market cap of $4.5 trillion, roughly 14 times Cisco’s current value.
But Cisco is angling to benefit from the AI craze, with CEO Chuck Robbins in November touting $1.3 billion in quarterly AI infrastructure orders from large web companies. Total revenue approached $15 billion, which was up 7.5% year over year, compared with 66% growth in 2000.
Shares of Cisco are up about 36% so far in 2025, outperforming the Nasdaq, which has gained about 22% over the same period.
WATCH: Cisco CEO on latest quarter: AI demand from hyperscalers is accelerating
Larry Ellison, Oracle’s co-founder and chief technology officer, appears at the Formula One British Grand Prix in Towcester, U.K., on July 6, 2025.
Jay Hirano | Sopa Images | Lightrocket | Getty Images
Oracle is scheduled to report fiscal second-quarter results after market close on Wednesday.
Here’s what analysts are expecting, according to LSEG:
- Earnings per share: $1.64 adjusted
- Revenue: $16.21 billion
Wall Street expects revenue to increase 15% in the quarter that ended Nov. 30, from $14.1 billion a year earlier. Analysts polled by StreetAccount are looking for $7.92 billion in cloud revenue and $6.06 billion from software.
The report lands at a critical moment for Oracle, which has tried to position itself at the center of the artificial intelligence boom by committing to massive build-outs. While the move has been a boon for Oracle’s revenue and its backlog, investors have grown concerned about the amount of debt the company is raising and the risks it faces should the AI market slow.
The stock plummeted 23% in November, its worst monthly performance since 2001 and, as of Tuesday’s close, is 33% below its record reached in September. Still, the shares are up 33% for the year, outperforming the Nasdaq, which has gained 22% over that stretch.
Over the past decade, Oracle has diversified its business beyond databases and enterprise software and into cloud infrastructure, where it competes with Amazon, Microsoft and Google. Those companies are all vying for big AI contracts and are investing heavily in data centers and hardware necessary to meet expected demand.
OpenAI, which sparked the generative AI rush with the launch of ChatGPT three years ago, has committed to spending more than $300 billion on Oracle’s infrastructure services over five years.
“Oracle’s job is not to imagine gigawatt-scale data centers. Oracle’s job is to build them,” Larry Ellison, the company’s co-founder and chairman, told investors in September.
Oracle raised $18 billion during the period, one of the biggest issuances on record for a tech company. Skeptical investors have been buying five-year credit default swaps, driving them to multiyear highs. Credit default swaps are like insurance for investors, with buyers paying for protection in case the borrower can’t repay its debt.
“Customer concentration is a major issue here, but I think the bigger thing is, How are they going to pay for this?” said RBC analyst Rishi Jaluria, who has the equivalent of a hold rating on Oracle’s stock.
During the quarter, Oracle named executives Clay Magouyrk and Mike Sicilia as the company’s new CEOs, succeeding Safra Catz. Oracle also introduced AI agents for automating various facets of finance, human resources and sales.
Executives will discuss the results and issue guidance on a conference call starting at 5 p.m. ET.
WATCH: Oracle’s debt concerns loom large ahead of quarterly earnings
-
Sports2 years agoStory injured on diving stop, exits Red Sox game
-
Sports3 years ago‘Storybook stuff’: Inside the night Bryce Harper sent the Phillies to the World Series
-
Sports2 years agoGame 1 of WS least-watched in recorded history
-
Sports3 years agoButton battles heat exhaustion in NASCAR debut
-
Sports3 years agoMLB Rank 2023: Ranking baseball’s top 100 players
-
Sports4 years ago
Team Europe easily wins 4th straight Laver Cup
-
Environment3 years agoJapan and South Korea have a lot at stake in a free and open South China Sea
-
Environment1 year agoHere are the best electric bikes you can buy at every price level in October 2024