Water suppliers on Iran hacking alert

Britain’s water industry has been put on high alert after Iranian hackers launched a series of cyber attacks across the US.

More than a dozen American states have been hit by a coordinated wave of attacks on drinking and wastewater treatment facilities in recent weeks. Researchers suspect that the attacks were carried out by hackers with links to Iran.

Security experts have warned that Britain faces similar threats to its water supplies.

The National Cyber Security Centre (NCSC), which is part of GCHQ, issued an alert this week about the increased risk of attacks on sensors, valves and switches used to automate utilities.

While the NCSC did not name a particular sector or the nations involved, cyber security experts said water companies rely heavily on the type of technology known as “programmable logic controllers”, devices that control machinery such as wastewater systems.

The same technology was targeted by Iranian hackers in their attacks on US water companies.

One source said the warning from NCSC was aimed at industries including the water sector “for sure”.

The NCSC said it had seen “increased targeting of operational technology systems across multiple sectors globally, including in the UK”, and that it had been “engaging with sectors directly in response to this recent targeting”.

Businesses face a challenge in ensuring their hardware systems, such as logic controllers, cannot be accessed from the internet by hackers.

A water company, for instance, could need remote access to hardware systems, such as a valve or pump.

Water businesses contacted by The Telegraph said their hardware would not be accessible remotely from the internet.

Threat ‘far from theoretical’

Companies have been urged to ramp up their defences against cyber attacks amid a growing threat of disruptive hacks by hostile states such as Iran.

The Telegraph revealed last week that Iran shut down a UK power plant for four days in July.

The attacks, which took place at the same time as the hacks on US water facilities, were thought to be the most successful of their kind, and marked the first time the Iranian regime had succeeded in closing down such a facility in the UK.

It is understood that the plant affected was relatively small and that the outage had no impact on the UK’s wider power supply or energy generation.

Alan Woodward, a cyber security expert at the University of Surrey, said hackers were targeting the “systems that keep the water flowing and the lights on”.

He said: “Nobody thinks about the plumbing until it fails, and that is exactly why attackers are drawn to it, especially attackers who want to disrupt critical infrastructure.”

Jonathon Ellison, the NCSC’s director for national resilience, said: “Recent disruptive activity against operational technology makes clear that the threat to UK networks is far from theoretical. It is part of a broader trend in targeting we are seeing across sectors.

“Our advice is clear: operational technology devices do not need to be directly exposed to the internet and so we urge organisations to ensure they are not, to limit opportunities for malicious activity.”

A spokesman for Water UK, which represents suppliers, said: “Like other sectors, water companies work closely with the NCSC and follow their guidance.”