Over the past week, more than 30 community water systems in Minnesota were hit in what state officials described as a coordinated cyberattack. The attack was part of a broader surge in hacking attempts targeting water and wastewater infrastructure across the country, and investigators are looking into whether they were carried out by Iran-affiliated groups.

In the aftermath of these intrusions, federal agencies ― including the Federal Bureau of Investigation, Environmental Protection Agency and Cybersecurity and Infrastructure Security Agency ― have issued warnings to water utility operators to follow strict protocols and take other steps to reduce the risk of disruption.

But the attacks have certainly drawn attention to just how vulnerable the country’s water systems actually are, especially as more public utilities rely on internet connectivity.

“I’m increasingly worried about overdependence on undependable technology,” said Joshua Corman, executive in residence for public safety and resilience at the Institute for Security and Technology and founder of I Am The Cavalry, a nonprofit focused on cybersecurity for critical infrastructure. “There are critical infrastructure sectors that, if disrupted, could lead to losses of life.”

He noted that hackers have traditionally been more interested in stealing information or money through ransomware. But the latest apparent attacks suggest a troubling shift toward disruption and destruction.

“We’ve reached a pretty significant threshold in the last week of reporting,” Corman said. “It’s not that someone couldn’t attack water. We just probably assumed they wouldn’t.”

That assumption, he added, is no longer safe to make.

The attacks being reported target what are called programmable logic controllers, or PLCs, which are small devices that monitor things like pressure sensors and chemical levels, and control things like pumps and valves. According to CISA, hackers have been quietly compromising these devices, shutting off alarms and alerts without yet causing obvious damage.

“The newest CISA alert showed how they’re hiding and silencing or subverting trip wires and alarms,” Corman said. “So they’re quietly compromising lots of water systems, they weren’t doing damage yet, and they’re shutting off alarms. So what things would I want to be alerted to that I haven’t been alerted to yet?”

Chris Begley, a wilderness survival instructor and co-author of “The Emergency Playbook: A Bunker-Free Guide to Disaster Preparation,” laid out the range of risks.

“Cyberattacks could create unsafe drinking water,” he said. “Potential impacts include allowing untreated water into the system or ineffective treatment of water.”

In the current Minnesota situation, he noted, there have been no reports of contaminated water, but the possibility exists in more serious scenarios, especially with stealth actions like turning off alerts. Federal agencies have pointed to a loss of monitoring and control capabilities, loss of water pressure and flooding as effects of the latest wave of attacks.

Underpressurization ― when controls are shut down and water pressure drops ― is problematic because it can create a vacuum that pulls in ground seepage and contamination.

“Depending on the bacteria or what’s in the soil nearby, in an abundance of caution, they usually say boil the water in this case,” Corman said. “You can do that for your home, but it’s not useful for a hospital if you need sterile water.”

He noted that attackers could also burst water mains by adjusting the pressure too quickly ― something called “a water hammer attack.” And they could damage pumps by rapidly cycling them on and off, burning out the motors.

“The replacement time for these quarter-million-dollar devices ― usually three at a time, so three-quarters of a million dollars ― can often take a minimum of 12 to 18 months, so an incredibly long loss of service,” Corman said.

It’s difficult to quantify how long cyber-based disruptions to water systems could last, particularly as the source and target can vary.

“I don’t know the limits of the time that a cyberattack could disrupt service — certainly for days, but depending on the nature of the attack and what it takes to fix it, I can imagine that it could be much longer in some cases,” Begley said.

Corman pointed to a potential bottleneck based on a lack of IT and cybersecurity personnel at water facilities, which tend to rely on a limited pool of outside contractors called systems integrators. So there are the physical demands of replacing broken hardware, as well as technological slowdown as systems go offline and operate manually.

“Unless and until they can get more trustworthy equipment to re-enable their automation, manual downtime is slower, harder on the limited talent pool and more prone to mistakes,” Corman said. “And if it were a burst water main or damaged pumps, counties often share the equipment and the crews, so it would be first come, first served ― which could take a lot longer if you have quite a few of these concurrently.”

Major water system disruptions can impact hospitals, fire hydrants, chemical manufacturing, HVAC systems and so much more.

“There is a psychological dimension, too,” Corman said. “If people didn’t trust the safety of their drinking water, that could be very damaging. Sometimes we measure things in time, but other times we measure them in human impact, economic impact, mission impact, and psychological impact.”

But zooming in from those larger issues, there are small things people can do on an individual household level to be ready for a potential disruption of this nature.

Both Begley and Corman were emphatic that preparation doesn’t require panic or a full-on “prepper” mentality. It’s just practical thinking about a risk that most Americans have never had to consider before.

“Stocking up with water would certainly help households deal with this situation, and a stock of clean water is a good idea for everybody to have,” Begley said. “A household should have a gallon of water per day per person ― half to drink, half for food preparation and hygiene ― multiplied by the number of days you want to be prepared to be without water. The old suggestion was to prepare for three days without water, but threats to infrastructure from extreme weather events and now cyberattacks suggest that this may be too little.”

He recommended aiming for a two-week supply of water if possible.

Corman noted that the U.K. government has in recent years encouraged citizens to have a three-week supply of water and food on hand.

“That’s not a terrible suggestion because if there is a one-to-three week disruption for your municipality, you can theoretically weather that and release the pressure on your town to give them the space and time to to cater to the elderly or to those who need it most,” he said.

Don’t forget to have water options for your pets as well.

“Water filters, either the home type or camping filters, are not water purifiers and can not completely replace the treatment that a municipal water treatment system provides,” Begley said. “These filters would certainly work to make tap water safer, but it is important to understand the limits of filters and how they differ from municipal water treatment systems.”

He explained that municipal systems tend to focus on removing physical sediment and disinfecting for pathogens like viruses, bacteria and parasites. Many communities also add fluoride for dental health and adjust the pH to prevent toxic metals like lead and copper from leaching out of your household plumbing.

“Personal water filters can vary in effectiveness depending on what they are intended to do,” Begley said. “Many home filters like Brita filters use carbon filters and ion-exchange resin that improve taste, remove some chemicals, and reduce sediment but do not kill or remove all pathogens. Camping-style filters will filter out things down to a certain size, including bacteria, but many viruses are smaller and will not be filtered out. Purifying water like the municipal systems do with chlorine or ozone, using ultraviolet light purifiers or boiling water is the only way to be sure of killing viruses.”

He added that some municipalities filter out industrial chemical contaminations, like PCBs or PFAS, and some at-home charcoal or carbon filters may do the same. So boiling and camping-style filters won’t help you out there.

Still, for big bacterial concerns, a simple filter can be very useful.

“Camping style water filters can help by eliminating bacteria, the most common problem with untreated water, but purifying water ― with a UV water purifier, chemicals or by boiling water ― provides more protection,” Begley said. “If you can still get water through the tap, even if untreated, then that water can be boiled, filtered or otherwise purified.”

Corman pointed out that a large cache of bottled water at home is useful only if you stay home.

“If you have to leave to go somewhere to get medicine or something like that, you can drink out of a puddle or a rain barrel if you have things like a LifeStraw,” he said. “You can also add iodine to water ― just a small cache of pills can help with that. You can have rain barrels. You can have filtration units. There are also things you can buy at a camping store that can pump larger volumes of water than a LifeStraw. Those straws are great but they only last for a certain total number of liters.”

Having both a home supply and a portable option gives you more flexibility in different scenarios around water system disruptions.

“Knowing where you can find fresh water to purify or filter is important if there is no water service,” Begley added. “Is there a creek, river or lake nearby where you could get water that could be purified or filtered?”

He also pointed to the importance of having good containers.

“Do you have containers suitable for collecting water?” Begley asked. “Old water jugs help, and five-gallon water containers are for sale for under $20 in any camping section of a discount store.”

If water pressure drops, refrigeration and food manufacturing can be affected as well.

“Water is also critically important to cold storage for food,” Corman said. “So if there were either loss of water pressure or lack of usable water in those places, it also happens to be a good idea to have some amount of shelf stable food on hand. But you don’t need to do a pandemic-era hoarding type thing.”

He recommended having a reasonable amount of foods that won’t spoil quickly. And for anyone who depends on medications that require refrigeration or water for preparation ― insulin, dialysis, certain other treatments ― formulate a backup plan for those as well.

“There’s a huge difference between being a prepper and being prepared for short-term interruptions,” Corman said. “We’re not telling people to panic. But we can no longer afford to be naive. We’re entering an era, for the first time in a long time, where sometimes you might lose water ― and we don’t have a generator for water yet.”

Still, it’s worth keeping the risk in perspective. Bryan Koon, president and CEO of the emergency management consulting firm IEM, cautioned against over-indexing on a single unlikely threat.

“The likelihood of a cyberattack attacking your water supply is really low, and unless there was viable intelligence that was shared with the community, there’s no way to tell when it would occur,’ he said. “So, advising people to stock up on water for an unlikely event with an uncertain outcome isn’t practical. I would instead advise people to have the best emergency kit they can that fits their budget and their family, and adjusted for the natural and manmade hazards where they live.”

Such a kit should include basics like non-perishable food, batteries and flashlights ― and could also have a few gallons of water or more if there’s room to store it, he added.

“Now, this advice could change if we saw an increasing threat or frequency of attacks on water systems, or if people lived in a drought-stricken area or where the water system was prone to failure in the event of natural disasters,” Koon said. “In that case, the messaging would shift toward a greater level of readiness.”

By entering your email and clicking Sign Up, you're agreeing to let us send you customized marketing messages about us and our advertising partners. You are also agreeing to our Terms of Service and Privacy Policy.