Post Rock Rural Water District

Summary

A former employee hacked into a Kansas water utility's computer systems, intentionally disrupting water treatment processes to harm the public by interfering with cleaning and disinfection procedures. The attacker, charged by the U.S. Department of Justice, faced potential imprisonment and substantial fines for both compromising the network and tampering with the public water infrastructure. The incident endangered community safety by threatening to compromise critical water purification operations.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On March 27, 2019, Wyatt Travnichek, a 22-year-old former employee of Ellsworth Rural Water District No. 1 (operating as Post Rock Rural Water District), allegedly hacked into the utility's computer network. Travnichek had worked at the Kansas-based water district from January 2018 until his resignation in January 2019. According to U.S. Department of Justice indictment documents unsealed on March 27, 2019, he accessed the system remotely and executed actions that disrupted critical water treatment processes. Specifically, the intrusion interfered with the facility's cleaning and disinfection procedures, which are essential for maintaining safe drinking water standards. Federal prosecutors asserted these actions were deliberately taken with intent to harm the water district and its customers. The court filings did not disclose whether the sabotage attempts successfully compromised water quality or detail how authorities detected the unauthorized access. Lance Ehrig, Special Agent in Charge of the EPA's Criminal Investigation Division in Kansas, characterized the incident as illegal tampering that endangered public health for an entire community.

The U.S. Department of Justice charged Travnichek with two federal crimes: computer hacking and tampering with a public water system. If convicted, he faced a maximum penalty of five years imprisonment plus a $250,000 fine for the hacking charge, and up to 20 years imprisonment with an additional $250,000 fine for the water system tampering charge. This indictment occurred approximately two months after an unrelated February 2021 incident in Oldsmar, Florida, where an unidentified hacker infiltrated a water treatment plant via TeamViewer software and attempted to manipulate chemical levels. The Kansas case highlighted vulnerabilities in critical infrastructure security, with federal authorities emphasizing their commitment to prosecuting threats to drinking water systems under environmental protection laws. No operational impacts beyond the disrupted processes were documented in available records, and the judicial outcome for Travnichek remained unspecified in the disclosed materials.

Sources

Sources available to members: 1 source.