Thirty-plus Minnesota water utilities were hacked “last weekend,” according to a…

Brief

Minnesota water utilities were targeted in a cyberattack campaign aiming to induce pressure loss and chemical shifts, per a leaked BCA memo; NBC links the tactics to Iran-backed hackers. Pressure attacks that drop distribution pressure below 20 psi enable back-siphon contamination, while small chloramine-ratio changes can mobilize lead (DC 2001–2004 saw >1,000 ppb in some homes). Operators detected the intrusion within hours and layered plant defenses limited harm.

Why it matters

Thirty-plus Minnesota water utilities were hacked “last weekend,” according to a leaked BCA memo; attackers were reportedly attempting pressure-loss operations and NBC says the campaign has the hallmarks of Iran-backed hackers, coming days after a U.S. warning about Iran-linked targeting of infrastructure.

Key details

Pressure-loss attacks work by disabling treated-water pumps so distribution pressure drops below 20 psi, allowing cross-connection back-siphon of contaminated water; in the 2021 Oldsmar, FL incident an attacker raised sodium hydroxide from ~100 ppm to 11,100 ppm before an operator reversed the setpoint.

Small shifts in chlorine-to-ammonia ratios (chloramine attacks) can mobilize lead from old service lines because free-chlorine sensors don’t detect chloramines; Washington, D.C. (2001–2004) saw some homes test >1,000 ppb lead and years of elevated blood-lead in children. Minnesota operators detected the intrusion within hours, and layered defenses (pump interlocks, day tanks, local analyzers independent of SCADA) mitigated damage.

Thirty-plus Minnesota water utilities got hacked last weekend. The leaked BCA memo says the attackers were going for pressure loss. In 2021 in Oldsmar, Florida, an attacker reportedly ran sodium hydroxide from 100 ppm to 11,100 ppm before an operator reversed the setpoint. Pressure loss doesn't set off control-room alarms. A slow drift looks like normal demand. In a pressure attack, the attacker disables the treated-water pumps. Distribution pressure drops below 20 psi and cross connections back-siphon dirty water into the potable stream. In a chloramine attack, the attacker shifts the chlorine-to-ammonia ratio by a few percent. Lead can mobilize from old service lines. No free-chlorine alarm trips because free-chlorine sensors don't measure chloramines. Washington DC experienced that one by accident from 2001 to 2004. Some DC homes tested above 1,000 ppb for lead. Blood lead in DC kids stayed elevated for years. Water plants are built in layers: chemical pumps interlocked to treated-water flow, day tanks sized to cap any overfeed, local analyzers independent of SCADA. Operators caught the Minnesota intrusion in hours. This layered defense saved Minnesota.

NBC News (@NBCNews)

A cyberattack targeting more than 30 municipal water systems across Minnesota has all the hallmarks of Iran-backed hackers, a senior law enforcement official says. nbcnews.com/tech/security/mi…

Link

Minnesota cyberattack has hallmarks of Iran-backed hackers, source says

U.S. and state officials haven’t publicly identified a culprit. The state’s water systems were attacked days after the U.S. warned that Iran-backed hackers were targeting infrastructure.
nbcnews.com

— https://nitter.net/NBCNews/status/2083145734161829989#m