All articles tagged with #critical infrastructure
President Vladimir Putin signed a decree allowing the Russian government to temporarily seize control of critical infrastructure—including fuel and energy facilities, communications, transport and logistics—when private owners fail to protect them from escalating Ukrainian attacks, a move aimed at stabilizing functioning amid fuel shortages and strikes deep inside Russia.
Iran-backed hackers reportedly found vulnerabilities in U.S. and U.K. critical infrastructure, including water facilities in 12 states and a UK power plant, signaling Tehran’s intent to maximize disruption; experts warn the attacks expose lax defenses around water and energy networks and could presage further intrusions, following a U.S. advisory about Iran-linked groups targeting water systems.
A small UK power generator was shut for four days in July after a cyberattack attributed to hackers linked to Iran, with officials saying the wider energy system remained secure. The incident coincided with US warnings about Iranian cyber activity and led to government briefings for energy CEOs and updates to cybersecurity regulations.
A coordinated cyberattack briefly disrupted dozens of Minnesota water utilities and other states by breaching internet-connected controls at local plants, likely part of a broader Iranian operation. The incident exposed long-standing vulnerabilities in aging, under-resourced, small-town water systems and the ease with which PLCs can be accessed with weak or no passwords. While no deaths or widespread service loss occurred and taps remained drinkable, experts warn of greater risk and urge better cybersecurity, information sharing, and the possibility of unplugging critical controls from the internet to prevent future breaches.
A broad cyber campaign has hit local water systems in at least 12 states, causing degraded operations, pressure losses, and boil-water advisories in some areas, though drinking water remains safe. Officials point to vulnerable, internet-connected devices and long-standing underfunding of utility cybersecurity; attribution to Iran-linked actors is suspected by some, but not confirmed, as utilities increasingly shift to manual controls while defenses are strengthened.
A coordinated cyberattack hit the operational technology behind more than 30 U.S. water systems, including in Minnesota, over July 26–27, forcing some facilities to go offline or operate manually; Minnesota reported no drinking-water quality issues. Investigators say Iranian-affiliated actors are the leading, though not yet confirmed, suspects. The incident underscores vulnerabilities in aging, internet-connected water controls and the cybersecurity gaps facing smaller utilities, prompting CISA and EPA to urge isolating vital systems from untrusted networks and tightening access. Residents should follow official guidance, maintain emergency water, and beware scams as the nation reassesses water-system protections across roughly 170,000 U.S. facilities.
CISA warns of a rising trend of hackers targeting U.S. water and wastewater facilities by manipulating PLCs and changing passwords to lock operators, prompting boil-water notices and manual operation. Minnesota reported a coordinated attack affecting more than 30 community water systems earlier this week, with investigators briefly weighing a possible Iran link; the overall water infrastructure remains vulnerable as probes continue.
More than 30 Minnesota water systems were targeted in a coordinated cyberattack on July 26–27. Four cities disclosed impacts, but officials say drinking water remained safe and residents were not asked to change usage; Minnesota IT Services activated its incident-response efforts and is coordinating with federal and private partners to investigate and strengthen critical infrastructure security.
More than 30 Minnesota community water systems were targeted in a coordinated cyberattack affecting operational technology. State officials and partners, including MNIT and federal authorities, are investigating, with no disclosed list of affected communities and no reported changes in drinking-water usage as of Tuesday.
The EU has blacklisted members of Russia’s FSB-led Turla cyber espionage group for years of hacking and spying across Europe and Ukraine, targeting governments and critical infrastructure; the sanctions include travel bans and asset freezes on individuals and entities such as AST and NPP Gamma, with the UK also imposing penalties.
Anthropic says the US government has authorized redeploying Mythos 5 to a set of US organizations that defend critical infrastructure, after a directive earlier this month banned foreign nationals from using the firm’s Mythos 5 and Fable 5 models. The company will restore access to Mythos 5 quickly for these groups and continues working with the government to expand access and bring Fable 5 back for general use, as EU officials express concern about dependence on foreign technologies.
GCHQ chief Anne Keast-Butler warns that Russia is relentlessly targeting the UK's critical infrastructure, democratic processes, supply chains, and public trust as part of a broader hybrid warfare strategy, urging stronger cyber defenses, closer collaboration with tech, academia and the public, and urgent personal cybersecurity measures.
US officials suspect Iran-linked hackers exploited unsecured online automatic tank gauge (ATG) systems at gas stations to alter display readings without changing actual fuel levels; no physical damage has been reported, but the breach raises safety concerns about undetected leaks. Attribution remains uncertain, though Iran’s history of targeting energy infrastructure and ongoing regional tensions inform the investigation.
CISA unveiled the CI Fortify guidance urging water utilities, transportation and other critical infrastructure sectors to plan for geopolitical cyber outages by building isolation measures to protect OT and preparing recovery procedures, including system backups and manual operation, with targeted assessments and a renewed hiring push.
CISA, with Australia’s ASD and other partners, released guidance for organizations adopting agentic AI, detailing key security challenges and risks and providing actionable steps to design, deploy, and operate these systems while aligning AI risk management with established cybersecurity frameworks and strengthening oversight as adoption grows.