The FBI is investigating a cyberattack on an Olathe, KS company whose technology is used by water and wastewater systems across the country.
Micro-Comm, an Olathe-based manufacturer of control and monitoring technology for water utilities, discovered the breach July 31, according to a Reuters report published Wednesday. A ransomware group known as Barracuda has claimed responsibility for the attack.
The hackers claimed to have obtained about 644 gigabytes of data, representing roughly 850,000 files. Micro-Comm co-owner Jim Cote told Reuters that the compromised material did not include customer passwords or credentials used to remotely access the company’s equipment. The company also said sensitive information contained in affected files was encrypted.
The FBI’s Kansas City Field Office confirmed that it is in contact with Micro-Comm and is coordinating with other law-enforcement agencies. Micro-Comm is also working with the federal Cybersecurity and Infrastructure Security Agency, or CISA.
The Olathe attack comes during heightened concern about cyberattacks against America’s water infrastructure. Since July 27, water and wastewater utilities in at least seven states have reported cyber incidents to the FBI. Some of those attacks disrupted operations, including causing loss of water pressure and flooding.
Federal officials have investigated whether some of the recent attacks on water utilities are connected to Iranian-linked cyber activity. However, the Micro-Comm breach appears to be separate. Cote told Reuters that the FBI described the attack on his company as an opportunistic intrusion rather than one specifically targeting Micro-Comm or its customers.
Micro-Comm told customers in an Aug. 8 notice that it had experienced what it described as a limited malware attack and said the incident was not related to the water-system attacks receiving national attention. As a precaution, the company recommended that customers change their passwords.
The company develops systems used to monitor and control water and wastewater facilities. Cybersecurity researchers told Reuters that the release of Micro-Comm files does not mean any water utility itself was successfully compromised, although technical information obtained in a breach could potentially be useful to attackers in future attempts.
The FBI and Environmental Protection Agency have urged water utilities to remove industrial control equipment from direct exposure to the public internet, strengthen passwords and restrict remote access as attacks on water infrastructure increase nationwide.
Something Different Media Group