Communities

Protecting utilities, never finished, never enough

Nationwide cyberattacks on water systems highlights need for cybersecurity

NEW ULM - Last week, numerous cyberattacks against civic water systems were reported in multiple U.S. states, including 30 attacks in Minnesota communities.

New Ulm was not one of the communities impacted by the cyberattacks, but the incident has served as an important reminder of the constant need to monitor cybersecurity and keep evolving.

"The concern of a cyberattack is always in the background," New Ulm Utilities Director Brett Fleck said. "Attacks like this bring it to the foreground. Thankfully, we did not see any attack on our system, but this is a great opportunity to improve our defenses."

Fleck said New Ulm's public utilities system does get targeted by threats, but its firewall has kept out common hackers from damaging systems. Most of these attacks are from common hackers looking for a backdoor in the system. However, the recent round of attacks hitting U.S. utilities is believed to have come from foreign countries and agencies. Fleck said an attack by hackers backed by another nation would be another type of threat, which is why New Ulm is taking these new threats seriously.

Not all of these cyberattacks are against large municipalities. One of the Minnesota cities targeted by the recent cyberattack is Braham, with a population of 1,700 residents.

Braham's computerized system, which controls the city's well and water treatment plant, was targeted. The town was forced to disconnect its plant from the internet to prevent further attacks. The plant is now operating manually rather than remotely.

Fleck said if the worst were to happen in New Ulm, the city could also switch to a manual operation of the plant. He said utilities staff does have the experience and training to make the switch if necessary, but this is assuming the equipment has not been damaged by a cyberattack.

He said if an attacker can burn out a pump motor before the switch is made, switching out to manual control might not help.

Fleck said the only way to zero risk of a cyberattack on systems is to disconnect everything from the internet. However, to monitor all utility systems without remote access would require more employees and bringing in more consultants and high expense. Remotely monitoring systems and continually adapting cybersecurity is the lower-cost option for most cities.

Fleck gave credit to New Ulm for its approach to handling cybersecurity and information technology (IT). He said there was significant investment over the years.

Brandon Wortz, IT director for New Ulm, confirmed cybersecurity has been an ongoing priority for the Utility Department for many years, well before the recent wave of attacks.

He said his department is continually evaluating systems and applying security updates, reviewing emerging threats and working with other partner organizations on best practices.

"Recent events have prompted us to review our procedures once again, but cybersecurity is something we continuously try to improve rather than something we address only after an incident," Wortz said.

The recent attacks on the water system do offer an extra learning opportunity for the industry. Information for all of the recent attacks is shared by state and federal cybersecurity partners and can be used to improve other cities’ practices.

Wortz said he is pleased New Ulm's utilities were not affected, but he warned that cybersecurity is not something that should ever be considered "finished" or "enough" but rather something that is constantly evolving.

"We invest significantly in protecting our systems, but no Utility can responsibly claim to be immune from cyber threats," he said. "Our focus is on maintaining strong security practices, preparing for potential incidents, and continuously improving our defenses."

City Manager Chris Dalton said threats of cyberattacks are always going to be an issue as long as the city is connected to the internet, but he was confident in the city's ability to adapt to cybersecurity threats.

"Ultimately, we do spend a fair amount on our cybersecurity," Dalton said. "This is high on our priority list. [Wortz] takes this very seriously."

Wortz said he believes cybersecurity is an essential part of operating a city's critical infrastructure.

This raises the questions of whether cybersecurity infrastructure needs to be covered by each municipality or if state and federal agencies need to provide funding.

Wortz said New Ulm already benefits from some partnerships with state and federal agencies as well as collaborations with other local utilities, but said he would always advocate for more federal funding. He was concerned about potential federal cuts to the Cybersecurity and Infrastructure Security Agency (CISA) budget in 2027.

Dalton said if there was more funding from the state or federal government to fund cybersecurity, New Ulm would apply for it.

Fleck said the public utilities would always welcome a higher level of support from the state and federal government for infrastructure issues.

His hope is that these recent attacks on the U.S. water system will highlight the need for greater cybersecurity and help prioritize this as a notional concern.