Waco acquired the network segmentation technology from Elisity while Mike Searight served as the city’s chief information officer and later became a senior adviser to the company
During a visit to a water treatment plant the controls the branch library and the golf course register were all reachable on the same network and no one had ever been asked to inventory what devices were present
CISA identified over one hundred compromised systems in the water and wastewater sector in July, typically through controllers connected directly to cellular modems, and the FBI and EPA reported on July 30 that utilities in at least seven states had reported incidents since July 27, with press accounts suggesting a dozen or more states
The joint advisory issued on July 22 and revised the same day named Iranian affiliated actors and expanded the known targeting to include Schneider Electric, Siemens and possibly other controller brands
In Clayton County Georgia a pump station failed around one a.m. on July 27, a boil water advisory was lifted the next day and the authority serving more than two hundred sixty thousand people said unauthorized cyber activity may have contributed to the disruption
The vulnerable controllers were never part of the city network; they operated over public cellular links and the modem was absent from asset lists and network scans, yet carrier invoices listed every SIM the city paid for and accounts payable tracked those invoices, allowing a simple match to devices at no cost and starting Monday
Most of the systems sit outside the IT department on the organizational chart, each with its own budget, vendor and manager, the plant reports to public works, cameras and card readers were treated like light fixtures and only one IT engineer understood the full picture, a knowledge that disappears when that engineer leaves, leaving no clear accountability for the shared network
Reporting requirements also miss the point; Texas law requires a 48 hour report only for personal data breaches or ransomware, while an intrusion that seizes control of a controller falls outside that trigger, and the federal 72 hour rule is still pending with CISA targeting this month
The Texas Water Development Board added cybersecurity to the scoring criteria for the Drinking Water State Revolving Fund for fiscal year 2026, giving five priority points to projects that adopt a cybersecurity awareness plan within five years or that fix a deficiency identified in a cybersecurity assessment, and Waco segmented five treatment plants in forty three days using operating funds from an existing contract rather than a capital bond
Leaders are willing to invest in cybersecurity when they see a measurable difference, and the public scrutiny of taxpayer spending makes transparent funding choices essential for protecting critical water infrastructure
Com informações de: CyberScoop