The FBI is investigating another cyberattack in the United States’ water sector, this time involving a small developer of water utility technology.
The breach at the Kansas firm was apparently not part of a suspected Iranian-affiliated campaign against water plants in Minnesota and other states starting in July but highlights growing threats to water infrastructure.
Both the company and the FBI have confirmed the breach at Micro-Comm in Olathe, Kansas, which had not been previously reported. Responsibility was claimed by Barracuda, a relatively new ransomware group that says it is motivated by profit and is not government sponsored.
On August 6, the group published what it claimed was nearly 850,000 corporate files comprising roughly 644 gigabytes of data. Micro-Comm manufactures programmable logic controllers (PLCs), computerized devices used to manage machinery within critical infrastructure networks, specifically wastewater processing facilities.
The incident at Micro-Comm underscores the challenges of defending local American water systems and third-party vendors against increasing cyberattacks aimed at computer systems embedded across the nation's critical infrastructure.
The breach occurred amid a spate of late July hacks directed at PLCs in Minnesota and at least six other states. Cybersecurity experts believe those intrusions formed part of an ongoing Iranian-linked cyber campaign.
On July 30, the FBI and the Cybersecurity and Infrastructure Security Agency issued a warning that hackers were actively targeting PLCs from U.S.-based Rockwell Automation, France's Schneider Electric, and Germany's Siemens.
CISA subsequently noted on August 19 that threat actors were utilizing AI to streamline attacks on Siemens systems. The company later stated it was coordinating with CISA and affirmed that its products are safe.
Dixon Land, a spokesperson for the FBI’s Kansas City field office, said in an email that the bureau was in communication with Micro-Comm regarding the incident and coordinating with additional law enforcement entities. CISA referred inquiries to Micro-Comm.
Jim Cote, a co-owner of the firm, stated in an interview that the business identified the intrusion on July 31.
Cote noted that the documents released by the hackers did not include sensitive material such as customer passwords and credentials, which remain stored by clients, or information concerning Micro-Comm's capability to remotely access its hardware.
In an August 8 newsletter to clients, the business reported experiencing a limited malware attack, adding that any sensitive details contained within the files were encrypted. Micro-Comm stated the breach was "in no way related to water system hacks currently being reported on the news."
Cote added that the FBI advised the firm that the security breach was an opportunistic attack rather than one specifically targeting Micro-Comm, though the business advised customers to update passwords as a precautionary measure.
According to internet-monitoring platform Censys, approximately 200 deployments of the company's SCADAview CSX systems across U.S. states remain accessible via the internet.
An index of files compiled by cybercrime research platform eCrime.ch lists references to specific public-sector clients, including local municipalities and a U.S. military facility, along with staff names and technical product details such as diagrams.
Tom Hegel, a senior threat researcher at cybersecurity firm SentinelOne, observed that while the document leak does not indicate any water facility suffered operational disruption, the exposed data could assist malicious actors over time.
