Beginning in 2012, Russian hackers began probing US energy companies and electric utilities. Three years later, in 2015, they used similar access to Ukrainian utility companies to cut power for several hours to western Ukraine, and again a year later to the capital of Ukraine. , Kiev.
In 2017, Russian hackers penetrated far enough into a US power plant to manipulate its controls, stopping just before the sabotage. In the same year, hackers in Russia were caught dismantling security locks on a Saudi petrochemical facility that prevent catastrophic explosions.
In recent years, the United States has stepped up its own cyberattacks against Russia, with a series of strikes on the Russian electricity grid, which cybersecurity experts have equated to the digital equivalent of mutually assured destruction.
Other countries have also probed the American systems. In 2013, Iranian pirates were caught handling a small dam in New York. Officials were initially concerned that hackers from Iran were inside the much larger Arthur R. Bowman Dam in Oregon, where a cyberattack that dismantled the dam’s locks could have resulted in calamity. But investigators have determined that the hackers were instead inside the much smaller Bowman Avenue Dam that holds back a chattering stream in New York City, 30 miles north of Manhattan.
It‘s the attacks on these small municipal networks, like the Bowman Avenue Dam and Oldsmar Water Treatment Facility, that cybersecurity experts say they fear most. While large utility companies typically have complex protections in place, smaller water companies, electric power providers, and manufacturers often do not.
“These are the targets that concern us,” said Eric Chien, security researcher at Symantec. “This is a small municipality with probably limited budget and resources, which has deliberately implemented remote access so that employees and outside contractors can access it.”
This, Mr Chien said, makes him a ripe target.
Oldsmar has disabled remote access, said Al Braithwaite, the city manager. “We expected that day to come,” he said. “We talk about it, we think about it, we study it.”