Metro Atlanta water system hit by cyberattack possibly linked to Iran

Clayton County officials said Monday they experienced a temporary water service disruption last week, which could be part of a string of suspected cyberattacks that have struck municipal water systems across the country.

The news comes after the Federal Bureau of Investigation revealed that “malicious cyber actors” had hit water utilities in seven states in recent days. Local officials in Minnesota and Michigan have since confirmed their states were affected, but neither Georgia nor federal officials would confirm that Peach State water systems were among the targets.

It was also not immediately clear who was behind the cyberattacks.

Federal authorities have not publicly released information linking the suspected incursions to Iran or its proxies, but experts with the bipartisan Center for International and Strategic Studies have said cyberattacks from Iran and allies have been on the rise since the U.S. and Israel launched the war on Iran in late February.

Last week, a bulletin disseminated by the Georgia Association for Water Professionals, an industry trade group, to its members said top security agencies including the FBI and the National Security Agency warned that several Georgia water and wastewater utilities disruptions were “due to devices being hacked by operatives affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC) Cyber Electronic Command (CEC).”

In a statement, the FBI’s Atlanta office said it was “aware of recent public reporting” about the cyberattacks around the country.

“The FBI and our interagency partners are fully engaged to protect critical infrastructure and we remain well-equipped to protect against cyber threats of all varieties,” the agency said.

The Clayton County Water Authority, which provides water, sewer and stormwater services to more than 250,000 people, said its service disruption occurred on July 27 and only lasted a few hours. The system said in a statement on its website Monday that it took steps to protect public health, including issuing a boil water advisory.

“Water service was restored within hours, and the advisory was subsequently lifted after required water-quality testing confirmed that the water met applicable safety standards,” the authority’s news release said.

County water officials said they immediately notified and engaged with state and federal law enforcement authorities to ”investigate the incident, restore operations, and secure the affected systems.” Clayton County did not disclose additional details of the incident, citing the ongoing investigation, but said it does not believe customer billing or payment information was compromised.

Meanwhile, the FBI and other federal agencies have warned that hackers are targeting programmable logic controllers, which are used to control pumps and other equipment in water treatment plants. The agency recommends water system operators remove PLCs from “direct internet exposure,” bolster password protections and take other steps to ward off cybercriminals.

Gov. Brian Kemp’s office referred a request for information on the incidents to the Georgia Emergency Management and Homeland Security Agency, which declined to comment.

The Georgia Environmental Protection Division, which regulates water systems, said it was notified of the cyberattacks but did not provide additional information.