Rambler Gallo, a resident of Tracy, Calif., has been charged with maliciously damaging a computer after it allegedly infiltrated a network of a water treatment plant in Discovery Bay. The treatment plant serves water and sewer systems for 15,000 residents of the city of Discovery Bay. Gallo was an employee of a private Massachusetts company (Company A) that contracted with Discovery Bay to operate the city’s wastewater treatment plant.
Hackers typically does not like attacking critical infrastructure. Though, we have records on hackers attacking water treatment plant in Florida. This ledto a change in chemical composition of drinking water in a little town. There was also the case of hacking into the computer system of a water utility.
According to a press release issued by the US Department of Justice, Gallo deliberately removed the main operating and monitoring system for the refinery and then shut down the servers that ran those systems.
Gallo’s indictment charges include one charge of transmitting a program, information, code, and command to damage a protected computer, pursuant to 18 U.S.C. §§ 1030(a)(5)(A) and ©(4)(B)(i). Gallo faces up to 10 years in prison and a $250,000 fine, and the court can order additional supervised time, additional fines and damages if appropriate.
In March 2023, the Biden administration announced that it would make it mandatory for states to conduct cybersecurity audits of public water systems. Water systems are a critical infrastructure that is increasingly at risk of cyberattacks from both cybercriminal organizations and actor states, the US Environmental Protection Agency said.
In June 2021, a report published by NBC News reported that attackers attempted to compromise an unknown water treatment plant that serves the San Francisco Bay, the attack occurred on January 15th. The hackers gained access to systems at the station using a former employee’s TeamViewer account and attempted to manipulate the software used to purify drinking water. In February 2021, the Sheriff of Pinellas reported that attackers attempted to increase sodium hydroxide levels 100 times in Oldsmar’s water supply. The scenario described by Pinellas Sheriff Bob Gualtieri is alarming: An attacker tried to increase the level of sodium hydroxide, also known as lye, by 100 times in Oldsmar’s water supply.
In March 2021, the U.S. Department of Justice indicted Wyatt A. Travnicek, of Ellsworth County, Kansas, for accessing and tampering with the Ellsworth County rural water computer system. Travnicek accessed the computer system of the public water supply system on March 27, 2019 without permission. Travnicek worked for Ellsworth County on the rural water supply for about a year, remotely monitoring the plan by accessing Post Rock’s computer system. After gaining access to the public water supply, the man allegedly committed malicious acts that halted processes at the facility that affected cleaning and disinfection procedures.
In May 2021, WSSC Water suffered a ransomware attack targeting a portion of their network that runs non-essential business systems. In October 2021, a joint cybersecurity bulletin published by the FBI, NSA, CISA, and the Environmental Protection Agency revealed three more ransomware gang attacks on US wastewater treatment plants (WWS) this year.
The attacks became publicly known and took place in March, July and August 2021, respectively. The three sites affected by ransomware operators are located in Nevada, Maine and California. In all of the attacks, ransomware encrypted files on infected systems, and in one of the security incidents, attackers compromised a system used to control industrial SCADA equipment.
Three incidents, included in the bulletin:
- August 2021. Attackers used Ghost ransomware against a WWS facility in California. The ransomware variant was on the system for about a month and was discovered when three supervisory control and data acquisition (SCADA) servers displayed a ransomware message.
- July 2021. Cybercriminals used remote access to inject ZuCaNo ransomware into a wastewater SCADA computer at a WWS Maine facility. The cleaning system operated manually until the SCADA computer was restored with local control and more frequent rounds of operators.
- March 2021. Cybercriminals used an unknown variant of ransomware against a WWS facility in Nevada. The ransomware affected the victim’s SCADA system and backup systems. A SCADA system provides visibility and monitoring, but is not a complete Manufacturing Control System (ICS).
