Close Call, Clear Warning
Turning a Near-Miss Cyber Incident Into a Stronger, More Resilient Utility
A near miss brings a distinct kind of relief, along with the uneasy recognition that someone else’s crisis could easily have been your own. That was likely the reaction across the utility sector just a few months ago, when water utilities in at least 7 states were hacked.
After gaining remote access to internet-facing devices, the hackers changed IP addresses and passwords, leaving utility operators unable to monitor or control their equipment. No service disruption occurred, and water quality was not affected. But the attackers could have pushed equipment beyond its operating limits, damaged critical infrastructure, or manipulated treatment chemicals, with potentially severe public health consequences.
FBI Warning
Following the breach, the FBI and EPA issued a Public Service Announcement in late July warning critical-infrastructure owners and operators that malicious cyber actors were targeting operational technology devices and programmable logic controllers (PLCs). PLCs are industrial computers that automate machinery and processes by continuously reading sensor inputs, running stored programs, and controlling outputs such as motors, lights, and valves in real time. To reduce risk, the agencies recommended removing PLCs from direct internet exposure, placing them behind secure gateways and firewalls, using strong and unique passwords, and limiting communications to authorized control-system devices through access control lists.
Utilities Are Prime Targets
Although this series of attacks focused on water systems, electric and gas utilities face the same danger. Electric utilities, in particular, are high-value targets because nearly every industry and essential service depends on reliable power. From my experience in the electric cooperative world, cybersecurity is a standing C-suite priority and a persistent concern in executive offices and boardrooms.
Smarter, Faster Cyber Threats
The value of a near-miss lies in what an organization learns from it. In an increasingly connected world, cyber threats are becoming faster and more sophisticated. AI and other rapidly evolving technologies can help attackers identify and exploit weaknesses in utility hardware, software, and networks at unprecedented speed.
Top 5 Utility Vulnerabilities
Advisories from the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) highlight five recurring vulnerabilities across water, wastewater, and energy utilities:
- Internet-Exposed OT Devices: Publicly accessible control systems and PLCs that lack firewalls or network isolation are easy targets.
- Ransomware: Attackers encrypt utility IT systems, disrupt operations, and may trigger precautionary shutdowns.
- Legacy and Unpatched Systems: Outdated software and firmware leave known security flaws exposed.
- Third-Party Access: Attackers exploit poorly secured vendor tools, integrations, and remote-access connections.
- Insider Threats: Current or former employees may misuse access, while weak security practices can create unintended risk.
Grid & Technology Evolution Is Fueling Cyber Vulnerability
As the energy system evolves, investment is expanding the range of resources connected to the grid, especially in the electric sector. Distributed energy resources (DER), including rooftop solar, battery storage, electric vehicles, and charging infrastructure, can reduce peak demand, lower energy costs, and provide backup power. Yet their fast growth also adds thousands of internet-connected inverters and edge devices to utility networks. These devices process data at or near their physical source rather than sending all raw data to a central data center or cloud. The result is a larger attack surface and a blurring boundary between information technology and operational technology.
Threats Abound
Cloud-connected automation and analytics can improve grid operations, but they also introduce new pathways to safety incidents, outages, and reputational damage. Attackers who compromise DERs could inject false data, issue disruptive commands, move from edge devices into critical systems, or threaten substations and grid stability.
Energy demand is surging, driven in part by AI and the electrification of economies worldwide, and cyber threats are accelerating with it. As governments strengthen defenses against nation-state actors and harden public-sector systems, attackers may turn to more vulnerable targets, including utilities. Smaller and rural utilities can be especially exposed because lean IT teams must monitor email, remote access, and every other potential entry point. The encouraging news is that utilities are sharing threat intelligence and leading practices through industry working groups that monitor emerging cyberattacks.
Warning Signs
A near miss is not a victory. It is a warning and an opportunity to close known gaps, avert a crisis, and protect the communities the utilities serve. However, even with strong systems in place, changes in team structure, new vendors, and updated operating systems can introduce new vulnerabilities. Effective cybersecurity requires constant vigilance and proactive measures, including detection programs, regular security audits, disciplined incident reporting, and rigorous analysis.
A close call gives utilities a chance to learn before they suffer the consequences. By studying attacks on peer organizations, leaders can uncover hidden vulnerabilities and address operational weaknesses before a real incident causes harm.
