Insurance
Home›Insurance›Property Insurance›Cyberattacks on US water systems reignite insurers’ wa…
Cyberattacks on US water systems reignite insurers’ war-exclusion debate
The attacks affected water system technology in at least seven states, and utilities in Minnesota and Michigan reported more than 30 community systems impacted in Minnesota and nine in Michigan.
A surge of cyberattacks targeting US water utilities has brought renewed scrutiny to cyber insurance wording, particularly the so-called war exclusion, according to Insurance Business. Media reports say malicious activity affected water system technology in at least seven states, with more than 30 community systems in Minnesota and nine in Michigan among those impacted.
Federal authorities are investigating whether Iranian hackers were behind the activity, though the attacks had not been definitively attributed. The incidents primarily targeted programmable logic controllers and other operational technology used to remotely monitor and manage water infrastructure, leading some utilities to shift to manual operations.
Officials said drinking water quality and public health were not compromised. The reporting also highlights cybersecurity strain at smaller public utilities, which often rely on aging systems, limited budgets, and operational technology that was not designed to connect to the internet.
Steph Barnes, a senior intelligence analyst at Resilience, said state-backed attacks have long been a primary risk for critical infrastructure, but the current geopolitical climate could broaden the exposure, with attackers attempting faster, more public-facing actions rather than covert pre-positioning. Federal guidance has urged operators to remove publicly exposed controllers and other operational technology from the internet and to review external connections through cellular modems, vendors, and integrators, with risk modeling remaining difficult for smaller utilities.