Georgia water systems were hacked. Were minicomputers the way in?

As federal investigators sound the alarm about a string of recent cyberattacks that have hit water utilities across the country, a pair of Georgia water systems have revealed they were among the targets hackers infiltrated last week.

Clayton County Water Authority officials said Monday a service disruption that temporarily knocked out water to parts of the county last week is under investigation as a possible cyberattack. On Tuesday, Columbus Water Works said that it too suffered a breach, though the utility said its service was unaffected. Both systems have stressed that their water supplies are safe.

State and federal law enforcement officials and local water authorities have been tight-lipped about exactly how hackers gained access to the Georgia water systems. But federal authorities have warned about an increase in attacks on a type of minicomputer commonly used by water utilities and other organizations.

Experts say the devices, known as programmable logic controllers (PLCs), are found in a range of facilities across the country, from water treatment plants to hospitals, according to Saman Zonouz, an associate professor of cybersecurity and privacy at Georgia Tech.

He says PLCs are more rugged versions of the simple controllers in home thermostats that tell air conditioning systems when to kick on. In a water treatment plant, they can be programmed to handle a single function, like opening or closing valves when water levels reach a certain threshold, or dispensing precise amounts of chlorine in the treatment process.

A view of the Terry R. Hicks Water Production Plant in Jonesboro, which is operated by the Clayton County Water Authority. (Arvin Temkar/AJC 2023)

There are thousands of PLCs controlling critical infrastructure across the country. Like other computers, they can be susceptible to hacking if they aren’t properly protected.

“If that gets hacked into, then that’s the brain of the system and the attacker has control over your system,” Zonouz said.

Erin Thomas, a spokeswoman for the CCWA, said she could not confirm whether PLCs were used to disrupt the county’s water service because the agency is “still awaiting report findings on what caused the system outage.” Columbus Water Works did not immediately respond to questions about how the cybercriminals broke into their systems.

The CCWA provides water, sewer and stormwater services to more than 250,000 people. Columbus Water Works serves a population of more than 260,000 people around the Columbus area.

On July 30, the federal Cybersecurity and Infrastructure Security Agency published an alert that it had observed a “significant increase in cyber threat actors targeting programmable logic controllers,” specifically in the water and wastewater sectors. The notice urged operators to “remove publicly exposed PLCs … from the Internet as soon as possible.”

“Threat actors targeting exposed PLCs have modified passwords to lock out operators and disconnected the PLCs by changing their IP (Internet protocol) addresses,” CISA’s July 30 notice reads.

Indeed, PLCs that are connected to the internet are most vulnerable to tampering, Zonouz said. And there are lots of them out there.

In an exercise reported in a 2024 paper, Zonouz and his colleagues used an automated scanner to scour the web for PLCs that could potentially be accessed by the public. They found thousands of the devices around the world that could be exploited.

The devices, the researchers found, were engaged in controlling everything from water treatment facilities to power grids to manufacturing plants. But Zonouz said water and wastewater plants are often especially vulnerable because of a relative lack of investment in their cyber defenses.

“It is actually more vulnerable and it’s a perfect target,” he said.

Law enforcement has also said little about the attackers’ identities, but a bulletin disseminated by the Georgia Association for Water Professionals, an industry trade group, indicated the operatives were affiliated with Iran. Experts with the bipartisan Center for International and Strategic Studies have said cyberattacks from Iran and its allies have been on the rise since the U.S. and Israel launched the war on Iran in late February.

Kristan VandenHeuvel, director of impact and engagement for The Water Tower, a Buford-based think tank and incubator focused on water utilities, said cybersecurity “has become an increasingly important area for water and wastewater utilities of all sizes.”

“As critical infrastructure becomes more connected through digital systems, utilities are looking for practical strategies to strengthen resilience, reduce risk, and prepare their workforce to respond to cybersecurity issues,” VandenHeuvel said in a written statement.

For now, some large water systems around metro Atlanta say they were not compromised, while others are staying mum.

A spokesperson for the Atlanta Department of Watershed Management said the agency is aware of the spate of the attacks but did not respond directly to a question about whether its facilities were breached.

“We remain vigilant in our efforts to reduce cyber risk, strengthen system resilience, and ensure the continued delivery of safe, dependable services to the residents and businesses in Atlanta and surrounding cities,” the spokesperson said.