Two New Jersey municipal water systems were targeted in cyberattacks this past week, and automated monitoring and management were temporarily disabled, the New Jersey Cybersecurity and Communications Integration Cell said Wednesday. Staff shifted to manual operations and the state said there was no disruption to service. Customers had uninterrupted access to safe drinking water throughout.
Blinded automation, intact service—and a revealing gap
The incidents involved vulnerable internet-exposed control systems that temporarily limited operators’ ability to monitor or manage the plants remotely, according to the state. NJCCIC is working directly with the affected utilities alongside the FBI and the Cybersecurity and Infrastructure Security Agency. A fix for the underlying software vulnerability has been issued, and utilities across the country running the same software are racing to assess exposure.
That sequence – automated controls go dark, human operators take over, customers keep getting water – is both operational success and operational warning. Success because trained staff preserved service. Warning because the attack did not need to damage physical infrastructure to remove remote visibility and control. When the primary management path is compromised or blinded, detection can be delayed and automated defenses may be moot: the system does not know it has been commandeered, and cannot act against commands arriving on the compromised channel.
Beyond patches: an independent way back in
Patching the vulnerable software is essential. But remediation plans that stop at patches and segmentation leave an operational question unanswered: if remote control is lost or spoofed, how does the rightful operator regain control without relying on the same channel the attacker controls?
One operational approach is an authenticated, alternate recovery channel – a deliberately separate path that first severs the attacker’s access to the primary control link and then lets the operator send safe, authenticated commands. Examples: isolate a segment, safely stop equipment, report state, or restore operator control. The alternate channel might be a cellular or SMS path to an auxiliary controller on the site, or an out-of-band path outside the plant network that the municipal owner can reach independently.
The Stormfire patent family (US 11,092,957; US 11,679,894; US 12,037,132) describes this out-of-band, two-step recovery idea: cut the attacker off first, then act over the independent channel.
Patches will reduce the immediate risk. The longer test is whether utilities fold operational recovery into their fixes – not as a headline item, but as the quiet capability that turns a blinded screen into actionable control when it counts.
Related coverage: 2 New Jersey municipal water systems targeted in cyberattacks — ABC News