Flushable wipes and Iran: Water treatment facility adds cyberattacks to worry list

toggle caption Claire Harbage/NPR

In a small town in southern Vermont, not far from the lauded ski slopes of Okemo, there's water gushing out of the back of a treatment facility.

For Chris Hughes, the assistant water and wastewater operator for the towns of Cavendish and Proctorsville, it's just another problem and another day on the job. This time, he's pretty sure a lightning strike disrupted the water treatment process. Other times, it's a build-up of iron in the system, a missing manhole cover, or an influx of "flushable" wipes, which he says routinely gum up the system. "I haven't had a lot of jobs, but it is by far the most interesting job that I've ever had," he told NPR during a tour of the facilities. "And so you have to … you have to like it. You have to kind of care."

Sponsor Message

Hughes is a master at fixing whatever's broken. But now, he's facing a new threat: hackers burrowing into the system and wreaking havoc.

It's not a fantasy or some far-off possibility; it's already happening all over the United States.

Iranian hackers infiltrated computer systems at a water treatment plant in Aliquippa, Pa., to display anti-Israel messages in November of 2023.

toggle caption Gene J Puskar/AP

A water system overflowed in rural Muleshoe, Texas, in January of 2024, an attack that's been linked to Russian hacktivists.

And across the country in recent years, U.S. officials say, Chinese hackers have burrowed deep inside American critical infrastructure, including its water systems, in order to prepare for a potential future conflict with the United States.

Those are just a few examples of what the U.S. Environmental Protection Agency has labeled a growing problem, concluding that "cyberattacks against [community water systems]" are "increasing in frequency and severity across the country."

Now, as the threat grows, Hughes and the towns he represents are participating in a pilot program pairing the people who run American critical infrastructure with volunteers who know how to secure it.

They've got a difficult task ahead of them.

toggle caption Claire Harbage/NPR

Hackers might have hesitated in the past to intentionally disrupt the systems that underpin American society, fearing retaliation or escalation. But after years of minimal consequences and hefty financial rewards, hackers have increasingly targeted critical infrastruct