Securing Critical Infrastructure from Cyber Threats: A Wake-up Call for Energy and Utility Sectors

In recent years we have seen businesses across the globe adopt digital operating models – and utility companies are no exception. These national companies – that are keeping critical infrastructure afloat providing water, gas, electricity, and waste treatment services – are using a plethora of different systems, online platforms, and applications to run their businesses. These systems bring a wealth of benefits, they make it simple for customers to track their usage and bills online and arrange payments, they streamline operating models, and make it easy to structure processes and collect & share data across the organisation. But this reliance on digital infrastructure has also increased the scope for cyber-attacks in the energy sector and provided new entry points.

Recent warnings from credit rating agency Moody’s have shed light on the elevated risk that utilities companies face from cyber attackers targeting their operations. Moody’s stated that “Critical infrastructure sectors like electric, water and other utilities have the highest risk exposure” due to a “growing reliance on digitisation”. They highlight that it “doesn’t necessarily mean they lack strong cyber defenses. However, a successful attack on their assets and services can have significant consequences” for both homes and businesses.

The utilities sector is becoming increasingly digitised through the introduction of smart meters, online portals and third-party software applications – broadening the attack surface for cyber criminals as they seek to infiltrate systems, compromise data, and disrupt supplies. It’s not just customer data that hackers are looking to steal and exploit, they are also looking to target insecure operational technology to interrupt supply – causing widespread disruption like power cuts and contaminated drinking water.

Read our blog on 10 ways to improve your cybersecurity.

Cyber Attacks on Water Companies are Hitting the Headlines

The report from Moody’s has sent a clear message, cyber-attacks on water companies have been prevalent and nobody is immune. Recent attacks have hit well known players who likely already have a strong cyber security posture. Recently Southern Water – who supply over 4 million customers in the UK – stated that Black Basta ransomware group claimed to have accessed their systems and posted a “limited amount” of their data on the dark web. In addition, Staffordshire Water issued an apology after hackers stole personal data relating to their customers – Moody’s estimate that the costs related to the hack – including potential civil claims – could reach £10m. In Ireland, 180 people were left without water when hackers targeted a water pumping system by taking control of a poorly protected industrial control system.

Over in the US they are facing similar problems.  In 2023 hackers attacked Aliquippa’s municipal water system and managed to shut down a pump on a supply line serving over 6k customers. News also leaked of a cyber security incident at Veolia North America who supply water to the city of Rahway in New Jersey. Moody’s pointed out that the use of artificial intelligence (AI) could further accelerate this worrying trend of cyber-attacks on utilities providers.

However, Moody’s cautioned although cyber-attacks like data breaches have a significant impact on data privacy & reputation, “The greater risk for the sector, and society, is if malicious third parties are able to access operational technology systems to impair drinking water or wastewater treatment facilities.” These systems often rely on older Operational Technology (OT) and control gear which was created prior to the internet that has often been retrofitted for remote access. This makes them easier to hack as this older equipment lacks modern cyber security protocols. If supplies of drinking water are contaminated or stopped all together this can cause a significant impact to the health of the population and can cause threat-to-life – creating maximum disruption & impact from these malicious attacks.

How are regulators addressing the cybersecurity challenges facing utility companies?

Recognising the criticality of the situation, water suppliers, government bodies, and regulators have acknowledged the need to strengthen cyber defences. Ofwat who regulate the water sector in the UK, is assessing plans to raise bills from 2025 to 2030 to cover additional costs – enabling water companies to deliver a better service for customers and improve the environment – and part of this will likely include cybersecurity investments. This direction comes at a time, when the water industry is facing additional scrutiny for various issues, including sewage dumping and executive pay.

In the aftermath of the cyber-attacks on the water sector, the Environmental Protection Agency (EPA) is advocating for water companies to voluntarily integrate fundamental cyber measures into their planning and operational processes. The EPA water Sector Cyber Security brief suggests a number of controls that water companies can implement to protect themselves from ransomware attacks.

Recent regulatory changes have introduced new cyber regulations for organisations providing Critical National Infrastructure (CNI), these include the Telecoms Security Act introduced in 2021, DORA the Digital Operational Resilience Act that will impact financial services organisations and their Information & Communication Technology (ICT) service providers, and the eagerly anticipated NIS 2 directive.

It is essential for water companies and others in the utilities sector to recognise these vulnerabilities highlighted by regulators and take proactive steps to protect their operations and customer data.