Arkansas water plant struck by cyberattack, safe to drink water

The City of Arkansas City has become the victim of a cyberattack involving its water treatment facility. As security experts are trying to remedy the situation, the local government assures its citizens it’s safe to drink water.

The ‘cybersecurity incident’ as the city calls it, got noticed last Sunday early in the morning, when IT employees observed that a computer wasn’t working. They reported the incident to the authorities and took precautionary measures to make sure the water drinking facility remained operational.

Shana Adkisson, Communications Director with the City of Arkansas City, told local news outlet KWCH that a screen popped up that displayed a note from the threat actor.

“We’re not even for sure who the individual or entity was that created this event, what happened, where it happened and if we’re safe to move on,” she said.

Cybersecurity experts and government authorities are currently working around the clock to resolve the situation and to make sure the water plant returns to its normal operations. The City of Arkansas City states it has taken ‘enhanced security measures’ to protect the water supply and its quality. Officials from the FBI and Department of Homeland Security are investigating the cyberattack.

“Despite the incident, the water supply remains completely safe, and there has been no disruption to service. Out of caution, the Water Treatment Facility has switched to manual operations while the situation is being resolved. Residents can rest assured that their drinking water is safe, and the City is operating under full control during this period,” City Manager Randy Frazer said in a statement.

Cyberattacks on critical infrastructure are becoming more and more common nowadays for threat actors. If a cyberattack is successful, it could disrupt an entire society. On a larger scale, such attacks could pose a serious threat to a country’s national security.

“Fortunately, there was no disruption to the water supply, and sensitive information remained secure. However, similar attacks could easily result in more severe consequences. This event reinforces the need for heightened vigilance and continuous improvements in cybersecurity across this sector,” cybersecurity specialist Itay Glick said in an emailed statement.

This is not the first time hackers have targeted water treatment facilities in the United States. In February 2021, an attacker was able to gain access to the Oldsmar water treatment plant in Tampa, Florida. Two years later, investigation showed it wasn’t a cybersecurity incident, but a clumsy employee who pressed the wrong buttons before notifying his supervisors of his blunder.

In April 2024, a hacker attempted to breach Tipton Municipal Utilities, a wastewater treatment plant in Indiana. Maintenance personnel were able to secure the facility.