Kansas Water Plant Pivots to Analog After Cyber Event

A water treatment facility in a small city took serious precautions to prevent any bad outcomes from a hazy cyber incident.

The water treatment facility for a small city in Kansas experienced a cybersecurity incident on the morning of Sept. 22.
Arkansas City — population 12,000, a two-hour drive north of Oklahoma City — sits at the junction of the Walnut and Arkansas Rivers, the latter of which supplies the towns drinking water. A notice from the citys Environmental Services Administration revealed that on Sept. 22, its treatment facility experienced a
cybersecurity incident.
Authorities were contacted and precautionary measures taken. Most notably, the facility moved to fully manual operations — a temporary decision made out of caution, according to city manager Randy Frazer in the notice.
Despite the incident, the water supply remains completely safe, and there has been no disruption to service, Frazer wrote. Residents can rest assured that their drinking water is safe, and the City is operating under full control during this period.
The administration added that Cybersecurity experts and government authorities are working to resolve the situation and return the facility to normal operations. Enhanced security measures are currently in place to protect the water supply, and no changes to water quality or service are expected for residents.
Dark Reading has reached out to Arkansas City for more information about the incident. In lieu of details, Shawn Waldman, CEO and founder of Secure Cyber, points out that a switch to manual operations could indicate some degree of seriousness.
In a breach that we investigated last November, we actually never went to manual mode, he recalls. We were able to isolate the human-machine interfaces (HMIs) and keep the Russian malware contained, and we let the plant operate as normal. Theres a lot of strain on employees when you put a plant in manual mode. Thats the last case scenario — you dont want to go into manual mode unless you have to.
Industrial control systems have long struggled to match old, legacy equipment to the demands of modern day cybersecurity.
Less often spoken of is the opposite problem: newer facilities designed with greater connectivity in mind, which introduce attack surfaces that the dinosaur, often analog machines, didnt have.
The new 5.4 million-gallon-per-day water treatment facility in Arkansas City opened in February 2018. It cost $22 million to build, and sports
advanced technology
estimated to save the city up to 20% on operational and maintenance costs. The exact nature of its cybersecurity posture is unknown.
Just because a city comes out and says: We just upgraded everything, and its all new, and we should be good — well, thats great, but what about cybersecurity? asks Waldman. Some cities are not making a proper investment into securing their critical infrastructure.
My city did that exact thing: I know for a fact that they did not upgrade cybersecurity, but they spent around $14 million or more to upgrade all the infrastructure.
To ensure that cities dont leave security out of their budgets, Waldman says, The EPA and Congress need to step up and get that new EPA standard for cybersecurity passed. They tried to do it before, and
then they got sued
. And what did we give up? Weeks after that,
Iran launched a bunch of attacks
on the water systems in the United States. Because, big surprise, Iran reads the US news.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Kansas Water Plant Pivots to Analog After Cyber Event