America’s drinking water is facing attack, with links back to China, Russia and Iran
Houston Chronicle/hearst Newspapers Via Getty Images | Hearst Newspapers | Getty Images
The City of Wichita recently had an experience that’s become all too common — its water system was hacked. The cyberattack, which targeted water metering, billing and payment processing, followed the targeting of water utilities across the U.S. in recent years.
In going after America’s water, hackers aren’t doing anything special. Despite rising fears of AI use in cyber threats, the go-to criminal way into systems remains preying on human foibles, be it via phishing, social engineering, or a system still running on a default password — “old school” cyberattacks, according to Ryan Witt, vice president of cybersecurity firm Proofpoint.
The rising cybercrime wave targeting key infrastructure led the Environmental Protection Agency to issue an enforcement alert warning that 70% of water systems it inspected do not fully comply with requirements in the Safe Drinking Water Act. Without quantifying an exact number, the EPA said some have “alarming cybersecurity vulnerabilities” — default passwords that have not been updated, vulnerable single login setups, and former employees who retained systems access.
While the methods may be simple, an attack last year by an Iranian-backed activist group against 12 water utilities in the U.S. reinforced how purposeful “an attacker’s mindset” can be, according to Witt. The targeted utilities all contained equipment that was Israeli-made.
FBI, NSA, CISA all express concern
In February, the FBI warned Congress that Chinese hackers have burrowed deep into the United States’ cyber infrastructure in an attempt to cause damage, targeting water treatment plans, the electrical grid, transportation systems and other critical infrastructure. A Russian-linked hack in January of a water filtration plant in a small Texas town, Muleshoe — located near a U.S. Air Force base — caused a water tank to overflow. “Water is among the least mature in terms of security,” Adam Isles, head of cybersecurity practice for Chertoff Group, recently told CNBC.
Psychological impact on the population is also a strategic aim, seen not only in targeting of water assets but the Colonial Pipeline hack that made national headlines in 2021, and in the words of the federal Cybersecurity and Infrastructure Security Agency, featured “snaking lines of cars at gas stations across the eastern seaboard and panicked Americans filling bags with fuel, fearful of not being able to get to work or get their kids to school.”
Attacks on U.S. water utilities’ IT systems can have a similar psychological impact, and even if the attacks don’t directly interfere with the operations of the utility, still lessen public trust in water supply. No hack to date has shut off the water to a population, but that’s the bigger worry, said Stuart Madnick, an MIT professor of engineering systems and co-founder of Cybersecurity at MIT Sloan.
Meddling with a water supply through attacks targeting IT (informational technology), like Wichita’s system, is minor in comparison to a successful attack on the OT (operating technology) that controls water plants. That is a massive risk, Madnick said, and the threat of it happening is not zero.
“We have demonstrated in our lab how operations, such as a water plant, could be shut down not just for hours or days, but for weeks. It is definitely technically possible,” he said.
A recent letter sent by EPA Administrator Michael Regan and National Security Advisor Jake Sullivan to the nations’ governors detailed the urgency of the threat. But Madnick is wary of the government’s ability to act quickly or robustly enough to prevent such an occurrence. Budgets, outdated infrastructure, and reluctance to move on an issue that may seem both vital and daunting suggest that the fixes may indeed not come quickly enough. “It has not happened yet, and serious action to prevent ‘likely’ will not happen, until after it has happened,” he said.
Outdated water utility technology
Like any modern system, water utilities rely on technology for monitoring, for operations, and for customer communication. The technology creates vulnerabilities — for providers and users — so the need for enhanced security measures is acute. “The community risk from cyberattacks includes an attacker gaining control of the operations of a system to damage infrastructure, disrupt the availability or flow of water, or altering the chemical levels, which could allow untreated wastewater to be discharged into a waterway or contaminate drinking water provided to a community,” said an EPA spokesman.
Witt says there are some initial steps to take in improving the cyber hygiene of dated systems. “Improving password strength, reducing exposure to public-facing internet, and the need for cybersecurity awareness training,” would go a long way to shoring up defenses, he said. Another potential fix is the deployment of what are called air-gapped systems that separate supervisory and control systems from other networks. Since the easiest way into these systems is to obtain credentials and then exploit the system, “A systems admin should not be able to access office systems such as email and be able to operate a control panel of a water system from the same laptop,” Witt said.
For the most part, attacks that have occurred have been preventable, according to the EPA. “Systems were victimized by destructive and costly cyberattacks because they failed to adopt basic cyber resiliency practices,” the EPA spokesman said. “All drinking water and wastewater systems are at risk — large and small, urban and rural,” he said.
While it has not been a tool needed to date in these water utility attacks, AI is coming alongside the concerted cyber efforts of geopolitical rivals. “Rapid advances in artificial intelligence are giving cyberthreat actors more sophisticated tactics, techniques, and procedures to penetrate operational technology that controls critical infrastructure facilities,” the EPA spokesman said. “These attacks have been linked to a variety of types of malicious actors, including hackers working on behalf of or in support of other nations who could use disruptions to U.S. critical infrastructure to their strategic advantage.”
The Amazon Prime logo is displayed on Amazon delivery trucks in Richmond, California, June 21, 2023.
Justin Sullivan | Getty Images
Department of Justice officials on Tuesday charged members or associates of an Armenian organized crime ring with stealing more than $83 million worth of cargo from Amazon by posing as legitimate truck drivers and siphoning off goods destined for the company’s warehouses.
Since at least 2021, at least four people linked to the crime ring carried out a scheme across California to steal truckloads of merchandise, ranging from smart TVs and GE icemakers to SharkNinja vacuums and air fryers, the DOJ alleged.
“At present, Amazon is plagued by recurring thefts of its shipments, which is commonly referred to as ‘cargo theft,'” the complaint says.
Amazon has ramped up its efforts to track and shut down fraudulent, deceptive and illegal activities on its sprawling online store. Eliminating stolen goods is particularly challenging. CNBC reported in 2023 that Amazon suspended dozens of third-party merchants it alleged were selling stolen goods, though many of those sellers claimed they were unknowingly caught in the scheme, putting their businesses at risk of survival.
Amazon isn’t the only retailer afflicted by cargo theft. Experts told CNBC cargo theft-related losses are estimated at close to $1 billion or more a year.
In its complaint, the DOJ said the alleged fraudsters operated four transport carriers — AK Transportation, NBA Holdings, Belman Transport and Markos Transportation — that would obtain contracted freight routes from Amazon Relay, an application used by truckers to obtain work, also referred to as loads.
Each trucker is assigned a load for pickup from a manufacturer’s warehouse to be dropped off at an Amazon facility. Instead, the groups would divert from their designated routes, take a portion of the goods off the trucks and resell them or gift them to associates, prosecutors allege.
In some cases, the “self-styled carriers” would complete their deliveries at an Amazon warehouse several days after they were expected to show up, according to the complaint.
DOJ officials seized the alleged fraudsters’ iPhones and found photos and videos of warehouses lined with boxes of crockpots, Keurig coffee machines, keratin shampoo, Weber grills and other goods.
Amazon teams cooperated with DOJ officials in their investigation, including sharing information about the stolen goods, and details of the alleged fraudsters’ accounts on its online marketplace.
Representatives from Amazon didn’t immediately respond to a request for comment.
DOJ officials linked the defendants to a litany of other alleged crimes, including attempted murder, kidnapping, illegal firearm possession and health-care fraud. Several of the 13 defendants are expected to appear in a Los Angeles district court on Tuesday and Wednesday, while one of the defendants appeared in a court in Fort Lauderdale, Florida, on Tuesday and was detained.
Thomas Fuller | SOPA Images | Lightrocket | Getty Images
Apple approved the Epic Games title Fortnite on Tuesday, returning the first-person shooter game to the App Store in the U.S., five years after its removal.
Fortnite was kicked off the App Store in 2020 after Epic updated its game over the web to take payments directly, instead of through Apple’s in-app payment mechanism, which takes fees up to 30%. The move angered Apple and kicked off a years-long legal battle.
Last month, Epic scored a victory in court, when a judge ruled that Apple wasn’t allowed to charge a commission when apps link out for payment, or dictate whether the links look like buttons. Epic said last week that it had submitted Fortnite to the U.S. App Store. To return, Fortnite had to pass App Review, Apple’s process in which new apps or updates are reviewed by Apple employees to ensure they work and adhere to the company’s guidelines.
Apple had dragged out its approval process for the app since May 9, when Epic submitted it to Apple. Last week, Epic filed a legal challenge, and on Monday, a judge said that Apple had to explain why Fortnite hadn’t been approved yet or come to a resolution with Epic over the game’s status.
Apple is appealing the latest court order, and looking to get a pause enabling it to roll back changes the company has already made to the App Store in response. An Apple representative didn’t immediately return a request for comment.
Last month’s ruling led major app makers such as Amazon and Spotify to change their apps to accommodate links to buy content. For example, users can now buy Kindle books inside the Kindle app on an iPhone.
Amazon and Spotify were able to update existing apps that had already been approved with changes enabled by last month’s order. After Epic sued Apple, the iPhone maker revoked Epic’s developer account in addition to booting Fortnite.
Epic was able to get a European developer account and now offers Fortnite in Europe through a third-party app store under the Digital Markets Act, which went into effect last year. IPhone users can also play Fortnite through cloud gaming services. But even in Europe, Apple tried to terminate Epic’s account before backing off, Epic said.
The fees that Apple takes from the App Store are an increasingly important part of Apple’s business. They’re reported in Apple’s Services business, which also includes advertising, AppleCare warranties, payments, and subscription offerings such as Apple TV+. Apple reported nearly $27 billion in services revenue during the March quarter.
A Waymo self-driving car, seen with a driver, stops at a red light outside the U.S. Capitol in Washington, D.C., on Friday, March 31, 2025.
Bill Clark | CQ-Roll Call, Inc. | Getty Images
Waymo co-CEO Tekedra Mawakana told CNBC on Tuesday that the Alphabet-owned ride-hailing company has reached 10 million trips, doubling in the past five months.
“These are all paid trips, and they represent people who are really integrating Waymo Driver into their everyday lives,” said Mawakana, speaking at the Google I/O developer conference. The 10 million figure includes rides in Austin, Los Angeles, San Francisco and the Phoenix area.
Waymo is delivering more than 250,000 paid robotaxi rides a week, Alphabet said in its April earnings report. On Monday, Waymo said it had won approval to expand its autonomous ride-hailing service to more parts of the San Francisco Bay Area, including San Jose.
The robotaxi company is part of Alphabet’s “Other Bets” unit. Revenue in the overall category fell 9% in the first quarter from a year earlier to $450 million, and operating loss grew from to $1.23 billion from $1.02 billion a year ago.
While those figures include a number of businesses, Mawakana confirmed that Waymo is not yet profitable but that the company is “super focused on building a sustainable business.”
“We’re proving out that it can be a profitable business,” she said. “There’s a path to profitability.”
Waymo faces potential competition from Tesla, which has promised to launch its robotaxi service in Austin next month. Tesla CEO Elon Musk told CNBC on Tuesday that the plan was still on track, and that the company will start with about 10 vehicles and rapidly expand to thousands if the debut goes well with no incidents.
Musk said Tesla aims to bring its robotaxis to Los Angeles and San Francisco following the planned Austin launch. He has previously claimed Tesla’s “generalized” approach to robotaxis is more ambitious than Waymo’s. Tesla primarily relies on camera-based systems and computer vision instead of using sophisticated sensors including lidar and radar in its vehicles.
Mawakana said that Waymo has taken what it views as the “safest path.”
“There’s probably a lot of ways it can be done, but we’re the only ones that have done it,” she said. “We’ve been doing it 24 hours a day for almost five years. And so to us, it’s really important to focus on safety, not focus on safety and then cost — not cost and then safety.”
WATCH: Waymo co-CEO announces 10 million autonomous trips milestone
-
Sports3 years ago‘Storybook stuff’: Inside the night Bryce Harper sent the Phillies to the World Series
-
Sports1 year agoStory injured on diving stop, exits Red Sox game
-
Sports2 years agoGame 1 of WS least-watched in recorded history
-
Sports2 years agoMLB Rank 2023: Ranking baseball’s top 100 players
-
Sports4 years ago
Team Europe easily wins 4th straight Laver Cup
-
Environment2 years agoJapan and South Korea have a lot at stake in a free and open South China Sea
-
Environment2 years agoGame-changing Lectric XPedition launched as affordable electric cargo bike
-
Business3 years agoBank of England’s extraordinary response to government policy is almost unthinkable | Ed Conway