SURPRISE, AZ — As cyberattacks against water utilities continue to raise concerns across the country, officials in Surprise say they are closely monitoring threats and investing in protections to keep the city's water and wastewater systems secure.
The issue has become a growing national security concern. At least a dozen states have reported possible cyber incidents involving water and wastewater utilities in recent days. Federal authorities continue to investigate several of the attacks, and cybersecurity experts have warned that critical infrastructure remains an attractive target for foreign adversaries and criminal groups.
“This is a slow economic drain, and they know that, right? They’re in this for the long game, and so anything that can disrupt operations of any kind,” said Zach Fuller, a cybersecurity expert with Silent Sector.
While disruptions to water treatment and delivery systems have generally been limited, the FBI has urged utilities to strengthen cybersecurity practices, including disconnecting systems from the internet when possible and ensuring manual controls remain available if digital systems are compromised.
Experts say municipal water systems can face unique challenges because many rely on aging infrastructure and technology.
“Municipalities and their water systems are very much vulnerable to attack,” Fuller said. “You have to remember, these are often legacy systems that are put in many, many years ago.”
In Surprise, Water Department Director Michael Boule said city officials treat cyber threats as a constant concern and closely monitor incidents occurring elsewhere in the country.
“We have a hypersensitivity to threats that occur throughout the country and the vulnerabilities that are exposed during these events,” Boule said.
According to Boule, the city conducts cybersecurity assessments every three to five years to identify vulnerabilities and adapt to emerging threats. While he declined to discuss specific security measures, he said the city remains confident in its defenses.
“All of our 22 well sites, all of our seven water supply facilities, each one of our four wastewater plants have, what I would call today as we sit here today, the best of the best as it relates to the protections that we can have in place,” Boule said.
Still, cybersecurity professionals caution that utilities must continue evolving as threats change.
Recent attacks have focused on programmable logic controllers, or PLCs, which are used to operate pumps, monitor water pressure and manage other critical functions. Many of those systems can be reached through internet-connected networks, creating potential opportunities for attackers.
“Which makes them especially vulnerable, so we need to put additional layers of security in front of those or put the appropriate patching and such in place,” Fuller said.
As municipalities across the country work to protect critical infrastructure, experts say cybersecurity has become as essential as physical security measures. For cities like Surprise, that means balancing day-to-day operations with constant vigilance against evolving digital threats.
City officials say they will continue reviewing security practices and learning from incidents affecting utilities elsewhere, while specialists emphasize that strong cybersecurity requires ongoing investment and attention rather than a one-time fix.
This story was reported on-air by a journalist and has been converted to this platform with the assistance of AI. Our editorial team verifies all reporting on all platforms for fairness and accuracy.
