Impact matters in cyber attacks and incidents. It matters much more than the rate or number of attacks. 100+ water utilities being hacked within two days is new. Is it important? What was learned? What did we already know?
Josh Reber and the team at Dispel responded to my call for a comprehensive document on the customer impact of the incidents. The table below shows what is available from public information, and the source links will be in the comments. Here’s the short version:
- Clayton County Georgia had a boil water notice for one day and some customers reported low water pressure.
- The 1,700 residents of Graham Minnesota were asked to minimize water use.
That’s it.
That impact does not warrant the hysteria and calls for mature OT security programs for small and medium water utilities. The question we should be asking is if this was what I call a Tier 2 incident in OT analogous version of API 754.
A Tier 1 incident is a high consequence event, i.e. people injured or dead, multi-day or longer water outages for a large number of people, or high replacement cost damage to physical infrastructure. A Tier 2 incident is when the attacker has OT system access to cause a Tier 1 high consequence event but does not. The attacker either lacks the engineering and automation skills or doesn’t want to cause the Tier 1 event.
Key Question 1: Were any of these July water incidents a Tier 2 event? (did we get lucky?)
This is what each utility and the state and federal governments should be asking and answering. My guess based on working with water utilities of all sizes is the answer will almost always be no for all but the large utilities. No, that level of access could not cause a Tier 1 high consequence event.
I could be wrong about the potential impact of access and control of the affected small and medium water utility systems. We need to know the answer. And I would not be surprised if a handful of the 100+ could have caused a high consequence event.
When the answer is yes, it was a Tier 2 event then:
Key Question 2: What can the utility do so that level of OT system access could not cause a Tier 1 high consequence event.
Reread that question. It does not ask how can I prevent the attackers from achieving that level of OT system access. There are a small number, three or less, of low cost security controls that are worthwhile for small water utilities, e.g. remove control from the Internet, firewall between IT and OT, two-factor authentication if you allow remote access. But asking a small utility to deploy and maintain a mature OT security program is a losing effort and poor use of resources from an all risk perspective.
We already knew from Shodan, US Government sources, and other scanning programs that there was a large, and not decreasing, amount of OT that was accessible to anyone with Internet access. The OT security community, asset owners, regulators, knew this and at some level accepted it. Even now removing this accessible from the Internet OT is just one of a long list of recommendations in complex programs that are being “stood up”.
If there is one security control to reduce likelihood in small utilities this incident should spurn, it is removing the unfettered Internet connection. This could be prioritized and progress, or lack thereof, tracked. Perhaps I missed it, but I haven’t seen this focused effort or data. 75 days post attack we should be seeing improvement.
Now here’s the data from consequence data available from public sources:
Impact Of July 2026 Water Utility Cyber Incidents
