Cyber Incident Victim: Water pumps in the province of Mateh Yehuda
Date:
Jun 2020
Location:
Israel
Summary
A cyberattack targeted agricultural water pumps in Mateh Yehuda, part of a broader series of intrusions against Israel's water infrastructure. The incident involved unauthorized access but caused no damage due to swift local repairs. This followed an earlier attack where hackers attempted to manipulate chlorine levels in water treatment systems, posing a risk of public harm if successful. Israeli authorities issued alerts urging password changes for internet-connected operational equipment, particularly chlorine control systems. While no formal attribution was provided for the Mateh Yehuda incident, the prior attack was linked by foreign intelligence sources to Iran, amid a backdrop of reciprocal cyber and physical disruptions affecting critical infrastructure in both nations.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In April 2020, hackers targeted Israel's water supply systems in an initial cyberattack, attempting to modify chlorine levels at water treatment facilities. This intrusion was detected and prevented before causing harm, though a subsequent Financial Times report in June revealed that successful manipulation could have led to mild poisoning of local populations. Israeli authorities did not formally attribute the attack, but the Washington Post cited foreign intelligence officials linking it to Iran. Following this incident, the Israel National Cyber-Directorate (INCD) and Water Authority issued alerts urging water facilities to change passwords for internet-connected equipment, particularly operational systems and chlorine control devices.
Two additional cyberattacks occurred in June 2020, targeting agricultural water infrastructure. The first impacted water pumps in Upper Galilee, while the second struck drainage installations in Mateh Yehuda, a central province. Both attacks caused no damage, as local operators promptly repaired affected systems independently. Israeli officials characterized the incidents as limited to small agricultural drainage systems with no real-world consequences. These June attacks unfolded amid escalating cyber tensions between Israel and Iran. In mid-May 2020, a retaliatory cyberattack attributed to Israel by U.S. intelligence sources disrupted operations at Iran’s Shahid Rajaei port. The initial April water system intrusion marked the beginning of a broader pattern of infrastructure disruptions in Iran, including unexplained incidents at nuclear facilities, power plants, and industrial sites throughout mid-2020.