Pipelines, power and water: why critical infrastructure is a cyber target

In May 2021 the DarkSide ransomware group hit Colonial Pipeline, which supplies an estimated 45% of the fuel for the US East Coast. The company took its pipeline operations offline as a precaution, sparking panic-buying and fuel shortages. Colonial reportedly paid about $4.4 million in cryptocurrency, of which the FBI later recovered about $2.3 million. Investigators reported that multi-factor authentication was not in place on the account used to get in, so one leaked password was enough.

Notice what was attacked: the business systems, not the pipe. Colonial shut the physical operation because it could no longer bill or track fuel safely. A criminal who only wants money can still stop a country's fuel.

In 2023, US agencies and international partners warned that a China state-sponsored group they call Volt Typhoon was seeking to “pre-position” itself in critical-infrastructure networks for “disruptive or destructive” attacks, and said it had kept access in some targets for at least five years. A February 2024 CISA advisory said it had compromised organisations across communications, energy, transportation and water and wastewater. China rejects the claims and has called them disinformation.

Pre-positioning means gaining access and waiting. There may be nothing to see until the day it is used. The difference from crime is the goal: not money but optionality in a crisis.

• Old control systems met the internet. Equipment designed in decades when it was isolated is now connected for monitoring and remote work. See why everything connected gets hacked.
• Little money and expertise. Local water utilities and small food suppliers do not have security teams.
• Dependencies are invisible. A store's cold chain depends on a controller vendor, a maintenance firm and an internet link. The fridge attacks hit a food chain through a part most shoppers never see.
• Attribution is hard, so deterrence is weak. The Belgian cyber centre said the culprit behind the November attacks may never be identified.

The EU Agriculture Commissioner's reaction to the French attack, quoted by CNBC, was that “the weaponization of food has become a reality”. (TIME quotes the same post as “exploitation”; the wording differs between outlets.) Whichever word is right, official language has moved from data protection to food security.

• US warns China could hack infrastructure, including pipelines, rail systems — Insurance Journal / Reuters (31 May 2023)
• CISA and partners release joint fact sheet for leaders on PRC-sponsored Volt Typhoon cyber activity — CISA
• Gas pipeline cyberattack, ransomware, Colonial — CyberScoop
• French supermarket fridges get hacked, heating to 122°F — CNBC