Imagine turning on your faucet and nothing comes out. Not because of a drought or a broken pipe, but because hackers got into the computer systems that control your local water supply.
It’s a real concern, and one that Southern California water agencies are taking seriously.
I recently visited a cybersecurity exercise in the Inland Empire where local government agencies, water districts and emergency responders came together to practice what they would do if hackers targeted critical infrastructure.
The event was organized through a regional cybersecurity coalition called ERNIE. The idea is simple: share information, identify weaknesses and practice responding to attacks before they happen for real.
The potential consequences are significant. A cyberattack could knock a wastewater treatment plant offline or disrupt water service to tens of thousands of customers.
Even more concerning, hackers who gain access to industrial control systems could potentially manipulate automated processes, including the chemicals used to treat water. Thankfully, utilities have safeguards and procedures designed to prevent dangerous changes.
At the exercise, participants worked through two simulated cyberattacks. One targeted water infrastructure, while the other focused on threats involving artificial intelligence.
AI is making things more complicated because it can help attackers identify vulnerabilities and carry out certain tasks much faster than before.
Another scenario that caught my attention involved hackers striking during a natural disaster.
Imagine a major Southern California earthquake that damages infrastructure and overwhelms emergency responders. Now add a coordinated cyberattack targeting the systems used to operate water facilities.
That’s the kind of situation emergency managers are preparing for.
One thing that stood out to me was how much of cybersecurity comes down to preparation and communication. These agencies weren’t just discussing firewalls and software. They were figuring out who makes decisions, who calls whom and how to keep essential services running when something goes wrong.
It’s similar to a fire drill. Practicing the response helps everyone react more confidently when the real thing happens.
And while most of us aren’t responsible for protecting a water treatment plant, many of the same cybersecurity lessons apply at home.
Use unique passwords, enable two-factor authentication, keep your devices updated and watch out for phishing scams.
The goal isn’t to assume every system will be hacked. It’s to make sure that if something does go wrong, we’re ready to respond.