Around 2012, Russian hackers began investigating American energy companies and electricity utilities. Three years later, in 2015, they used similar access to Ukrainian utility companies to turn off the power for several hours in western Ukraine and again a year later in the Ukrainian capital, Kiev.
In 2017, Russian hackers went far enough at an American plant to manipulate their controls, stopping just before the sabotage. That same year, hackers in Russia were caught dismantling security locks in a Saudi petrochemical facility that prevents catastrophic explosions.
In recent years, the United States has escalated its own cyber attacks against Russia, with a series of attacks on Russia’s power grid, in what cybersecurity experts have compared to the digital equivalent of mutually assured destruction.
Other nations have also investigated American systems. In 2013, Iranian hackers were caught manipulating a small dam in New York. Authorities initially feared Iran’s hackers were inside the much larger Arthur R. Bowman dam in Oregon, where a cyber attack that dismantled the dam’s locks could have resulted in calamity. But investigators determined that the hackers were inside the much smaller Bowman Avenue dam, which holds a murmuring stream in New York, 30 miles north of Manhattan.
It is the attacks on these smaller municipal systems, like the Bowman Avenue dam and the water treatment plant in Oldsmar, that cybersecurity experts say they fear most. While large utility companies generally have complex protections, smaller water utilities, electricity suppliers and manufacturers generally do not.
“These are the targets we care about,” said Eric Chien, a security researcher at Symantec. “This is a small municipality that probably has a small budget and few resources, which has purposely configured remote access so that employees and outside contractors can enter remotely.”
This, said Chien, makes them a mature target.
Oldsmar has disabled remote access, said Al Braithwaite, the city manager. “We anticipated that day would come,” he said. “We talk about it, we think about it, we study.”