Cyber Attack at Water System

A water system in Pennsylvania experienced a cyber attack over the weekend. Attackers were able to gain control of a remote booster station by attacking a programmable logic controller (PLC) made by the company Unitronics. There were no impacts to water quality or supply, and operators were able to run the station manually.

Water and wastewater systems are advised to do the following:

• Check if if any Unitronics PLCs are used at your system.
• Check for signs the PLC has been compromised. This may be a red background saying the unit has been hacked.
• If the PLC may have been compromised, take the device offline and switch to manual operations
• Confirm you are not using the Unitronics PLC default password of “1111”

Read more about this attack from WaterISAC
Read more from CISA
Learn about cybersecurity at vtruralwater.org/cybersecurity

​Proposed Changes to Lead and Copper Rule

The EPA just announced new Lead and Copper Rule Improvements (LCRI), which builds upon the 2021 Lead and Copper Rule Revisions (LCRR). This new proposal does not make changes to the required Service Line Inventory, which water systems must complete by October 16, 2024.

The proposed LCRI includes:

• Lead service lines must be replaced within 10 years.
• After creating the Service Line Inventory, systems must regularly update the inventory, create a service line replacement plan, and identify the materials of all service lines of presently unknown material.
• Changes to lead sampling—collect first liter and fifth liter samples and use the higher of the two values when determining compliance. 
• Lower the lead action level from 15 µg/L to 10 µg/L.
• Water systems with multiple lead action level exceedances would be required to conduct additional outreach to consumers and make filters certified to reduce lead available to all consumers.

Find more information on EPA’s website and this factsheet.

There will be an information webinar on December 6 at 2 pm. Register here.

There is a 60-day public comment period on this proposal. Submit comments online at www.regulations.gov, Docket ID Number: EPA-HQ-OW-2022-0801. There will also be a virtual public hearing on January 16, 2024—register here.