US warns Siemens devices can be hacked amid fears Iran is breaching water plants

Several US government agencies are warning that unidentified hackers are trying to breach devices made by Siemens that are used to monitor and operate water facilities and other critical infrastructure systems, according to a cybersecurity advisory.

The warning comes amid widespread cyber incidents targeting local water systems in multiple states in recent weeks in attacks cybersecurity experts suspect are linked to Iran.

The advisory describes an “active threat” to all Siemens S7 Series programmable logic controllers across multiple critical infrastructure sectors, including manufacturing, energy, water and wastewater, chemical, food and agriculture facilities, according to the warning issued by the National Security Agency, FBI, Department of Energy, Environmental Protection Agency and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency.

Depending on specific circumstances, compromises of these devices could lead to disruption of critical processes, safety incidents, downtime or equipment damage, compromise of sensitive data, compliance violations and cascading impacts across interconnected systems, the government warned.

Siemens does not immediately respond to a request for comment.

According to the advisory, the hackers are using AI to dramatically reduce the technical expertise and time required to develop exploits that can successfully compromise the systems, the agencies said.