U.S. authorities are investigating a data breach at a small maker of water utility technology, highlighting infrastructure cybersecurity threats even though the Kansas firm was apparently not part of a suspected Iranian-affiliated campaign against water plants in Minnesota and other states starting in July.
The company and the FBI confirmed the attack at Micro-Comm in Olathe, Kansas, which has not previously been reported. Responsibility was claimed by Barracuda, a relatively new ransomware group that says it is motivated by profit and is not government sponsored.
The group posted on August 6 what it said was nearly 850,000 company files with roughly 644 gigabytes of data. Micro-Comm makes programmable logic controllers (PLCs), computer devices used to control machinery within critical infrastructure networks, in this case by wastewater processing facilities.
The Micro-Comm breach highlighted the complexity of securing local U.S. water systems and the vendors that support them from increasing cyberattacks on computer systems embedded in the nation’s critical infrastructure.
The breach occurred during a late July spate of hacks that targeted PLCs in Minnesota and at least six other states. Cybersecurity experts believe the attacks were part of a long-running Iranian-affiliated cyber campaign.
The FBI and the Cybersecurity and Infrastructure Security Agency warned July 30 that hackers were targeting PLCs from U.S.-based Rockwell Automation (ROK.N), France’s Schneider Electric (SCHN.PA), and Germany’s Siemens (SIEGn.DE).
CISA said August 19 that hackers were using AI to ease their attacks on Siemens equipment. The company subsequently said it was working with CISA and its products are safe.
Dixon Land, a spokesperson for the FBI’s Kansas City field office, said in an email that the FBI was in contact with Micro-Comm about the hack and coordinating with other law enforcement agencies. CISA referred questions to Micro-Comm.
Jim Cote, a co-owner of the company, said in an interview that the company discovered the breach on July 31.
Cote said the files released by the hackers did not contain sensitive information such as user passwords and credentials, which are stored by the customer, or data related to Micro-Comm’s ability to remotely access its devices.
The company told customers in an August 8 newsletter that it experienced a limited malware attack and any sensitive information in the files was encrypted. The company said the breach was “in no way related to water system hacks currently being reported on the news.”
Cote said the FBI told the company that the data breach was an opportunistic attack not specifically targeted at Micro-Comm, and the company recommended customers change passwords out of an abundance of caution.
Roughly 200 of the company’s SCADAview CSX systems, one of the company’s products, in use in U.S. states are accessible from the internet, according to internet-monitoring firm Censys.
A list of files gathered by cybercrime research platform eCrime.ch refers to specific government customers, including localities and a U.S. military facility, employee names, and product information such as diagrams.
Tom Hegel, a senior threat researcher at cybersecurity firm SentinelOne, said the release of files did not mean any water system was operationally compromised, but the information could help hackers in the long term.
