Utility Hijack

A Utility Hijack is a cyberattack in which an adversary takes control of the operational systems that run a utility, such as a power grid, water system, or broadband network, and uses them to manipulate or shut down service. Most breaches only steal data. A hijack turns the utility’s own controls against it. Attackers may open breakers, change chemical dosing, reroute or drop network traffic, or lock operators out, often while making screens appear normal.

Two cases show how this works. In December 2015, Russian-linked attackers took remote control of distribution systems in western Ukraine and cut power to about 225,000 customers. In late 2023, Iran-affiliated hackers compromised internet-exposed industrial controllers at several U.S. water utilities, including one in Aliquippa, Pennsylvania, which forced operators to switch to manual control.

Smaller utilities are frequent targets. They often run internet-exposed controllers with default passwords and have little in-house security staff.

Countermeasures

• Remove internet exposure from control systems and change default credentials
• Segment operational technology from business IT networks
• Maintain manual override and local operation capability
• Keep critical control and monitoring functions on hardened, on-site infrastructure with independent power and backup connectivity
• Monitor sites for physical and electromagnetic tampering

Sources

• CISA, FBI, NSA, EPA. “IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities.” Advisory AA23-335A, December 2023.
• CISA. “Cyber-Attack Against Ukrainian Critical Infrastructure.” Alert IR-ALERT-H-16-056-01, February 2016.