Kyle Harris
BROWN CITY — The city has beefed up security on its water system after a recent cyberattack on one of its wells.
City Manager Kyle Harris told the Brown City Council Aug. 10 that hackers from possibly outside the country used the cellular network to change the Internet Protocol (IP) address on Well #3.
He said the data breach disrupted the ability for the well to produce water for several hours before DPW Foreman Mike Vislosky was able to correct the problem. No physical damage was done, and more security was added to the well systems.
According to news reports, several water systems in Michigan and at least six other states were targeted by cyberattacks earlier this month in which hackers changed critical information that locked out operators and prevented them from controlling water flow.
Harris said state and federal agencies will not confirm which municipalities were involved. Officials have not named a culprit, but according to U.S. intelligence authorities, Iran is a primary suspect.
Harris said through its insurance provider, the city has retained Pierson Ferdinand, a law firm which specializes in municipal cyber issues. The firm will represent the city in any communications with the vendor whose system was breached, giving the hackers access to the Brown City’s water system.
While security firms quoted between $17,000 to over $20,000 to track the matter, Pierson Ferdinand was hired by the council at its meeting for up to $5,000 that will be paid from the city’s general reserve fund balance.
The firm will also make sure Team UIS, a Dexter-based company the city uses for system control support for its municipal infrastructure, is doing everything necessary to keep the city’s water system safe.
“It is important to provide additional security to ensure our water system and its components are protected,” Harris said. “Fortunately for us, in this case, the hackers could not gain any further access into our system other than being able to turn well pumps on and off had they wanted to. However, doing so has the potential to ruin pump motors or other vital parts, costing significant amounts to repair or replace and leaving the city with a reduced water supply.”
The News reached out to other local communities about possible cyberattacks on water systems and heard back from Croswell, Lexington, Deckerville, Marlette and Sandusky, which all reported no attacks.
Lexington manager Max Garbarino said if village water system were attacked, there would be no danger because the system would be run manually.
Croswell Administrator Amy Planck said the city has installed software upgrades to protect the water system.