From about 2012, Russian hackers began investigating U.S. energy companies and electrical utilities. Three years later, in 2015, they used similar access to Ukraine’s utility companies to switch off the power for a few hours to Western Ukraine, and again one year later to the capital of Ukraine, Kiev.
In 2017, Russian hackers achieved enough in a US power station to manipulate its control and just stop sabotage. In the same year, hackers were caught in Russia dismantling the security latch at a Saudi petrochemical plant preventing catastrophic explosions.
In recent years, the United States has stepped up its own cyber attacks against Russia with a series of strikes on the Russian power grid, comparing cybersecurity experts to the digital equivalent of mutually assured destruction.
Other countries have also explored U.S. systems. In 2013, Iranian hackers were caught manipulating a small dam in New York. Officials initially feared that the hackers from Iran were in the much larger Arthur R. Bowman dam in Oregon, where a cyber attack that tore the lock off the dam could lead to disaster. But investigators determined the hackers were in the smaller Bowman Avenue dam blocking a chattering creek in New York, 30 miles north of Manhattan.
It is attacks on these smaller municipal systems, such as the Bowman Avenue dam and the water treatment facility in Oldsmar, that cyber security experts say they fear most. While large utility companies usually have complex protections in place, smaller water supply companies, electric power suppliers and manufacturers are often not.
“These are the targets we are concerned about,” said Eric Chien, a Symantec security researcher. “It’s a small municipality that probably has a small budget and not enough resources, deliberately setting up remote access so that employees and outside contractors can enter it.”
This has Mr. Chien said it was a ripe target.
Oldsmar has disabled remote access disabled, said Al Braithwaite, the city manager. “We expected this day to come,” he said. “We talk about it, we think about it, we study it.”