Moody’s Investors Service is warning over the growing risks of cyber attacks for water and wastewater companies in a new sector comment paper.
The global credit ratings agency and financial analysis provider said that over the last 18 months, a growing number of water and wastewater utility companies have experienced ransomware attacks.
The financial cost of remedial measures, including resecuring systems, strengthening existing cyber defences and potential fines, will typically result in only a modest increase in affected companies' leverage if the incident is short. However, the greater risk for the sector, and society, is if malicious actors are able to access operational technology (OT) systems to impair drinking water or wastewater treatment facilities.
Regulators, government bodies and licensees are cognizant of the need to bolster cyber defences given the growing sophistication of attacks on critical infrastructure, with state-aligned actors a recent but growing class of cyber adversary. Recent developments affirm Moody's view of the sector's very high overall cyber risk.
Phil Cope, Vice President, Senior Analyst at Moody’s commented:
‘’The water sector's exposure is rising as the sector is becoming increasingly digitalised through the installation of data logging equipment and smart meters, a trend we expect to continue given the need to reduce per capita consumption. Greater digitalisation introduces new vectors of attack for malicious actors, for example, pivoting an attack from the third party vendor used to provide some of the digitalisation services.
‘’Critical infrastructure sectors are already exposed to a broader array of malicious actors than other companies, including nations states who are seeking nonfinancial gain from disrupting other sectors of the economy. Russia's cyberattacks on Ukraine's electricity grid following its invasion of the country is one such example.’’
The sector comment paper refers to Southern Water’s disclosure earlier this month that it had experienced a ransomware attack, and a ransomware attack on South Staffs Water in July 2022.
Click here for more information