Hackers accessed monitoring systems at two New Jersey water departments but were unable to control water operations, officials said, raising concerns about the vulnerability of critical infrastructure systems. The Cape May Water and Sewer Department and the Woodbine Water Department were both aff ected by the incidents, officials said Thursday. Hackers gained access to monitoring systems but did not breach computers that control water operations. Cape May City Manager Paul Deitrich described the intrusion as limited. “They just went in and said, ‘Hi, we’re here,’ and left,” Deitrich said. The incidents follow a July 30 warning from the Cybersecurity and Infrastructure Security Agency (CISA) that cyber actors have been accessing utility systems and changing passwords. NBC News has reported that Iran is believed to be behind attacks affecting utilities in seven states, including New Jersey. While the recent New Jersey breaches were limited to monitoring systems, CISA urged utility companies to disconnect critical control systems from the internet, strengthen passwords and restrict remote access to reduce the risk of service disruptions or even physical damage. Matt Barnett, CEO of King of Prussia-based cybersecurity firm SEVN-X, said such attacks are often aimed at testing systems for weaknesses. “I think when you look at these types of attacks, the motivation is really about disruption to our way of life,” Barnett said. Attackers may be searching for vulnerabilities that could one day allow them to manipulate valves or alter chemical treatment systems used in water operations, Barnett said. However, he said there is no indication that happened in these cases and he is not directly involved in the investigations. “It’s possible that what we’re looking at now is access to the read-only components, or the kind of monitoring systems and not necessarily the systems that allow changes to those pieces,” Barnett said. Barnett warned that utility providers must remain vigilant and continue investing in cybersecurity protections. “These are things that keep the lights on, keep the water flowing for American citizens and anything that puts that at risk or has the potential to disrupt that could likely impact the lives and maybe even the safety of hundreds of thousands, millions of people,” he said. Officials in Cape May and Woodbine said their investigations remain ongoing with assistance from state counterterrorism officials. In addition to New Jersey, attackers targeted utilities in Michigan, Minnesota, Georgia and Wisconsin, according to NBC News and NBC Chicago. Several water agencies in Delaware, New Jersey and Pennsylvania told the NBC10 Investigators they were not affected and that their systems are not connected to the internet. On Friday, a bipartisan group of senators, including Pennsylvania Republican Sen. Dave McCormick, reintroduced legislation that would provide funding to help smaller utility companies strengthen their cybersecurity defenses. The proposal comes as federal officials continue to warn that water systems, power providers and other utilities remain attractive targets for foreign adversaries seeking to disrupt critical infrastructure. The NBC10 Investigators can be reached at [email protected] and [email protected]. ...read more read less