Cyberattack on U.S. Water Utility Highlights Critical Infrastructure Vulnerabilities A recent cyberattack targeted a small water utility in Aliquippa, Pennsylvania, disrupting operations and exposing gaps in the security of U.S. critical infrastructure. The incident, which occurred in late November 2023, involved the hacking of a booster station used to regulate water pressure in the town’s system. The attack was attributed to an Iranian-linked hacking group known as Cyber Av3ngers, which claimed responsibility for compromising the facility’s industrial control system (ICS). The group exploited a default password vulnerability in Unitronics programmable logic controllers (PLCs), a widely used component in water and wastewater management systems. While no physical damage or contamination was reported, the breach forced manual operation of the affected station, underscoring the risks of inadequate cybersecurity in essential services. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory in response, warning other utilities about the threat and urging immediate action to secure vulnerable systems. The attack follows a pattern of increasing cyber threats to water facilities, including a 2021 incident in Florida where hackers attempted to poison a city’s water supply by manipulating chemical levels. This incident serves as a stark reminder of the growing sophistication of state-sponsored and criminal cyber actors targeting critical infrastructure, with potential consequences for public safety and national security.