Years after sophisticated cyberattack on water system, small Massachusetts town says "anybody's a target"

As federal officials remain on high alert for cyberattacks targeting public water systems across the United States, leaders of a Massachusetts utility that was previously infiltrated by foreign hackers say the threat is something every community needs to take seriously.

At least seven states have recently been targeted, including Michigan and Minnesota, with investigators believing Iran may be responsible.

For Nick Lawler, general manager of the Littleton Electric Light and Water Departments, reports of attacks on public utilities are concerning but not surprising.

"No, I think this has been a common story in all of our industries that we work in for decades," Lawler said.

Despite the relatively small size of the communities LELWD serves, the utility has firsthand experience with a sophisticated cyberattack.

Systems accessed by hackers in 2023

In 2023, Lawler said the Department of Homeland Security and FBI notified the department that its systems had been accessed by China-based hackers.

"These attacks are highly sophisticated. That was a zero-day vulnerability attack, meaning that there were no fixes and no solutions to it when it happened to us," Lawler said. "And the cyber threat actors were highly sophisticated in the attack and didn't leave a lot of breadcrumbs. So, it took a while for our federal partners to identify it, and once they did, we were hand-in-hand with them to get them off our systems."

Lawler said the hackers never gained access to the department's operational technology systems controlling its electric grid and water infrastructure. Had the hackers eventually gained access to operational systems, Lawler said they potentially could have interfered with infrastructure controlling the water system, treatments, even cutting the flow.

Lawler said the discovery initially caught the department off guard because Littleton is a small community and the department does not operate bulk electric systems.

But the incident drove home a larger lesson: Size doesn't necessarily make a utility less attractive to hackers.

"What we've learned, and I think what you're seeing now in current events, is if you can impact tens to twenties to maybe hundreds of these type of instances at once that can also have a big impact," Lawler said. "I think that's kind of the world we live in now is that anybody's a target."

Cybersecurity improvement in Littleton

The experience led Littleton officials to make a series of cybersecurity improvements.

Assistant General Manager Dave Ketchen said the department added multifactor authentication wherever possible, segmented its networks and placed additional limits on what users can do at different points within the system.

"Our network is a lot less flat now and it's more of a broader network that you really have to jump through hoops to do anything on now," Ketchen said.

Ketchen said many local utilities can be attractive targets because of the amount of, in some cases, outdated operational technology they use.

"A lot of them unfortunately are soft targets, just based on how much operational technology equipment is in the systems today," Ketchen said. "It's never too late to start improving your cyber posture, cyber needs to be the focus of every decision that you make today, operationally."

Littleton officials said reports detailing other cyberattacks can provide important lessons for utilities across the country.

Lawler has also become outspoken about sharing Littleton's experience, saying utilities can learn from one another when attacks or near misses occur.

"We're just trying to help our industry peers learn from things that happened to Littleton," Lawler said.

As utilities again confront reports of cyberattacks elsewhere in the country, Lawler said openly discussing those incidents is critical.

"I just encourage utilities and utility operations personnel to continue to talk about these events and share our insights and share whatever happens with these threat actors because again it's the only way we're going to learn is from each other," Lawler said.

At the state level, Massachusetts Water Resources Authority officials said they are actively monitoring concerns about cyberattacks but have not discovered any of the same vulnerabilities in their system that are being exploited elsewhere.