A Review of Cybersecurity Incidents in the Water Sector
Open accessAbstract
This study presents a critical review of disclosed, documented, and malicious cybersecurity incidents in the water sector to inform safeguarding efforts against cybersecurity threats. The review is presented within a technical context of industrial control system architectures, attack-defense models, and security solutions. Fifteen incidents were selected and analyzed through a search strategy that included a variety of public information sources ranging from federal investigation reports to scientific papers. For each individual incident, the situation, response, remediation, and lessons learned were compiled and described. The findings of this review indicate an increase in the frequency, diversity, and complexity of cyberthreats to the water sector. Although the emergence of new threats, such as ransomware or cryptojacking, was found, a recurrence of similar vulnerabilities and threats, such as insider threats, was also evident, emphasizing the need for an adaptive, cooperative, and comprehensive approach to water cyberdefense.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The February 2021 attack on the Oldsmar water treatment facility in Florida involved an attacker remotely accessing the plant's computer system and attempting to introduce large amounts of sodium hydroxide to risky levels.
“the February 2021 attack on the Oldsmar water treatment facility in Florida, when an attacker remotely accessed the computer system of the plant and tried to introduce large amounts of sodium hydroxide to risky levels”
From Cyber-Physical Risk Assessment for U.S. Water Utilities: A Comprehensive Analysis of SCADA and Operational Technology Vulnerabilities (2025) · cites this paper as Hassanzadeh et al., 2020
The incident accounts in our copy describe other facilities, including Harrisburg in 2006 (section 4.2.1, p. 6) and a Florida utility in 2012 (section 4.5.1, p. 7). Searches for Oldsmar, February 2021, and sodium hydroxide found no passage addressing the claimed attack; the Harrisburg account mentions only a hypothetical change in disinfectant levels. (LLM, conf=0.78)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Battle of the Attack Detection Algorithms: Disclosing Cyber Attacks on Water Distribution Networks
Taormina, R., Galelli, S., Tippenhauer, N. O., Salomons, E., Ostfeld, A., Eliades, D. G., Aghashahi, M., Sundararajan, R., Pourahmadi, M., Banks, M. K., et al. (2018) · Journal of Water Resources Planning and Management · doi:10.1061/(asce)wr.1943-5452.0000969 · Cited by 277 · see citing works
Self-citationSmart Water Networks and Cyber Security
Rasekh, A., Hassanzadeh, A., Mulchandani, S., Modi, S., & Banks, M. K. (2016) · Journal of Water Resources Planning and Management · doi:10.1061/(asce)wr.1943-5452.0000646 · Cited by 87 · see citing works
Self-citation
Flagged first, then by citations
Research works printed but not linked: 16
- Chuadhry Mujeeb Ahmed, Carlos Murguia, and Justin Ruths. Model-based attack detection scheme for smart water distribution networks. In Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security , pages 101-113. ACM, 2017.
- Saurabh Amin, Xavier Litrico, Shankar Sastry, and Alexandre M Bayen. Cyber security of water scada systemspart i: Analysis and experimentation of stealthy deception attacks. IEEE Transactions on Control Systems Technology , 21(5):1963-1970, 2013.
- Sarin Chandy, Amin Rasekh, Zachary Barker, and Ehsan Shafiee. Cyberattack detection using deep generative models with variational inference. ASCE Journal of Water Resources Planning and Management , 2019.
- District Court at Maroochydore. Appeal against Conviction and Sentence Proceedings regarding Appellant Vitek Boden . Supreme Court of Queensland, Queensland, Australia, 2002. . Https: // archive.sclqld.org.au / qjudgment / 2002 / QCA02-164.pdf. (Aug. 15, 2019).
- David Formby, Srikar Durbha, and Raheem Beyah. Out of control: Ransomware for industrial control systems. In RSA Conference , 2017.
- Amin Hassanzadeh and Robin Burkett. SAMIIT: Spiral attack model in iiot mapping security alerts to attack life cycle phases. In 2018 International Symposium for ICS and SCADA Cyber Security Research (ICS-CSR 2018) , pages 11-20. eWiC, 2018.
- Amin Hassanzadeh, Shimon Modi, and Shaan Mulchandani. Towards e ective security control assignment in the industrial internet of things. In 2015 IEEE 2nd World Forum on Internet of Things (WF-IoT) , pages 795-800. IEEE, 2015.
- Eric M Hutchins, Michael J Cloppert, and Rohan M Amin. Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains. Leading Issues in Information Warfare & Security Research , 1(1):80, 2011.
- ICS-CERT. NCCIC / ICS-CERT year in review: FY 2015 . U.S. Department of Homeland Security, Washington, DC., 2016b.
- Ronald L Krutz. Securing SCADA systems . John Wiley & Sons, 2005.
- Aron Laszka, Waseem Abbas, Yevgeniy Vorobeychik, and Xenofon Koutsoukos. Synergic security for smart water networks: Redundancy, diversity, and hardening. In Proceedings of the 3rd International Workshop on CyberPhysical Systems for Smart Water Networks , pages 21-24. ACM, 2017.
- Daniel T Ramotsoela, Gerhard P Hancke, and Adnan M Abu-Mahfouz. Attack detection in water distribution systems using machine learning. Humancentric Computing and Information Sciences , 9(1):13, 2019.
- Nabil Sayfayn and Stuart Madnick. Cybersafety analysis of the maroochy shire sewage spill, working paper cisl# 2017-09. Cybersecurity Interdisciplinary Systems Laboratory (CISL), Sloan School of Management, Massachusetts Institute of Technology , pages 2017-09, 2017.
- Riccardo Taormina and Stefano Galelli. Deep-learning approach to the detection and localization of cyber-physical attacks on water distribution systems. Journal of Water Resources Planning and Management , 144(10):04018065, 2018.
- Riccardo Taormina, Stefano Galelli, Nils Ole Tippenhauer, Elad Salomons, and Avi Ostfeld. Characterizing cyber-physical attacks on water distribution systems. Journal of Water Resources Planning and Management , 143(5): 04017009, 2017.
- Joseph Weiss. Protecting industrial control systems from electronic threats . Momentum Press, 2010.
Cited by
Sorted by citations
Consumer, Commercial, and Industrial IoT (In)Security: Attack Taxonomy and Case Studies
Xenofontos, C., Zografopoulos, I., Konstantinou, C., Jolfaei, A., Khan, M. K., & Choo, K.-K. R. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3079916 · Cited by 183 · see citing works
Insider threat detection in cyber-physical systems: a systematic literature review
Al-Mhiqani, M. N., Alsboui, T., Al-Shehari, T., Abdulkareem, K. H., Ahmad, R., & Mohammed, M. A. (2024) · Computers and Electrical Engineering · doi:10.1016/j.compeleceng.2024.109489 · Cited by 53 · see citing works
Ahmadi‐Assalemi, G., Al‐Khateeb, H., Benson, V., Adamyk, B., & Ammi, M. (2025) · IET Cyber-Physical Systems: Theory & Applications · doi:10.1049/cps2.70004 · Cited by 10 · see citing works
Aniebonam, S. O., & Aniebonam, C. P. (2025) · Journal of Environment, Climate, and Ecology · doi:10.69739/jece.v2i1.1031
- Authors
- Hassanzadeh, A., Rasekh, A., Galelli, S., Aghashahi, M., Taormina, R., Ostfeld, A., & Banks, M. K.
- Affiliations
- Accenture (United States) (US)
- Texas A&M University (US)
- Singapore University of Technology and Design (SG)
- Delft University of Technology (NL)
- Technion – Israel Institute of Technology (IL)
- Corresponding author
- Rasekh, Amin
- Venue
- Journal of Environmental Engineering
- Published
- 2020-05
- Volume
- 146
- Issue
- 5
- ISSN
- 0733-9372 (ISSN-L)
- 1943-7870
- OpenAlex
- W3004344782
- Cited by
- 195
- References
- 2
- Citations by year
- 2026: 24 · 2025: 24 · 2024: 21 · 2023: 42 · 2022: 46 · 2021: 23 · 2020: 15
- FWCI
- 29.64
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- Journal of Environmental Engineering (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- Data Archiving and Networked Services (DANS) (submittedVersion, other-oa)
- Research Repository (Delft University of Technology) (submittedVersion)
- arXiv (Cornell University)
- Funders
- National Research Foundation (NRF2014NCR-NCR001-40)
- Fonds National de la Recherche Luxembourg
- Qatar National Research Fund (NPRP8-1292-2-548)
- Horizon 2020 Framework Programme (740610)
- Topics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Social Sciences › Political Science and International Relations › Cybersecurity and Cyber Warfare Studies
- Keywords
- cyber incidents, water sector, critical infrastructure security, industrial control systems, ransomware, cryptojacking, insider threats, cyberattack response, lessons learned
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
