COMMENTARY: Financial Risks of Cyber Incidents and How to Mitigate Them

By Pete Lund

The recent devastating droughts in the U.K. and the U.S. have driven water restrictions in affected regions, making Water and Wastewater facilities’ Operational Technology (OT) and Information Technology (IT) prime targets for cybersecurity attacks as the industry’s role in a safe and healthy society becomes more essential than ever. With the discussions of IT and OT digital convergence and recent government guidelines and executive orders, it is important to understand why and how the Water and Wastewater industries are especially at risk.

The Financial, Safety and Security Risks

Critical infrastructure organizations have three concerns when it comes to cybersecurity and the risk of an attack: first and foremost, the safety of its employees and people it serves, business continuity, and financial consequences. When looking at some of the more recent OT cyberattacks, the financial impact has been exorbitant. For instance, when the IT systems of the Colonial Pipeline were infected with ransomware in 2021, OT operations ceased the delivery of fuel to the East Coast of the U.S. primarily due to lack of visibility into OT. This, along with the nearly $5 million in ransom, caused substantial financial loss and lengthy downtime. Just over a year later, they’re facing additional, costly ramifications as the Pipeline and Hazardous Materials Safety Administration (PHMSA) seeks to implement fines totaling nearly $1 million in OT security regulation violations.