Austria
Belgium
Denmark
Estonia
Finland
France
Germany
Greece
Iceland
Ireland
Italy
Netherlands
Norway
Poland
Portugal
Spain
Sweden
Switzerland
Turkey
United Kingdom
Australia
New Zealand
Hong Kong
India
Indonesia
Japan
Malaysia
Philippines
Singapore
Thailand
Brazil
Chile
Colombia
Mexico
Peru
USA
Bahrain
Israel
Morocco
Oman
Tanzania
UAE
Turkey
Prefer us on Google
Converging risk: U.S. Cyber attacks on critical infrastructure are quickly becoming environmental disasters
The world is getting riskier. Critical infrastructure in the United States is at an inflection point, contending with increased aggregated risks across physical, environmental, and cyber threats, aging technology and operational technology (OT) systems amongst others and lagging resources to keep pace with these increased exposures. Cyber attacks on critical infrastructure like water treatment plants and energy grids are increasingly threatening to public safety and the environment.
The rise in frequency, speed, and sophistication
According to recent reports, state CIOs and CISOs are facing significant gaps in their ability to protect critical infrastructure at a time of increased threat activity. The multi-agency advisory co-authored by six federal agencies—including CISA, the FBI, the NSA, the Department of Energy, and the EPA—sounds the alarm on active campaigns targeting the hardware running city services, water plants, and power facilities.
Recent attacks such as the suspected Iran-nexus series of coordinated hacks targeting water utilities across the U.S., impacting drinking and wastewater utilities in at least 12 states where more than 100 internet-exposed systems were targeted illustrate a trend that shows no sign of slowing.
Artificial intelligence has significantly accelerated the threat landscape. According to recent reports by the McCrary Institute for Cyber & Critical Infrastructure Security at Auburn University, the U.S. is facing escalating cyber threats to critical infrastructure, ports, and operational technology (OT). They note that AI tools allow hackers to automate the scanning of internet-facing devices, identify software flaws, and write custom exploitation scripts in a fraction of the time it previously took.
Beyond the breach
All organizations have a multitude of challenges to navigate when contending with coordination regarding cyber attacks, particularly when those attacks are perpetrated by sophisticated cybercriminals (some even nation-state) and essential systems such as water facilities, transportation networks or energy grids are the key targets.
Prevention and preparation are the best defense mechanisms to withstand and properly manage these incidents. But what happens when a cyber attack results in physical damage, and worse, impacts drinking water, energy, and resources that individuals and businesses rely on every minute of every day? Whose liability is it and how can insurance play a role in supporting these services?
Any organization using computer-controlled valves, pumps, tanks, pipelines, or other operational systems may be exposed. A landfill may rely on remote systems for leachate collection or gas management, a fuel terminal may use digital controls to move petroleum products, a BESS facility operates through a digital network, and manufacturing or power facilities may use automated systems to manage hazardous chemicals and other physical processes. The common denominator is not the industry, but the ability to control physical infrastructure remotely. If an attacker gains access to a fuel terminal’s control system and opens a valve, the cyber policy may respond to the network compromise, while the resulting release could trigger containment, cleanup, environmental consulting, regulatory involvement, third-party claims, legal defense, and business interruption. Similar scenarios could arise wherever computer systems control processes capable of causing an environmental release.
Why critical infrastructure needs both cyber and environmental coverage
Cyber insurance and environmental insurance provide many services to support organizations undergoing a real-time attack, yet many local governments are underinsured or lack education on what services are available to them via their insurance product.
We have spent years separating cyber risk from environmental risk because they have historically lived in different parts of the insurance program. This distinction may no longer be relevant and certainly puts organizations in a worse place mid-event. Technology is increasingly controlling the physical environment, and that means a cyber event can become an environmental event almost instantaneously. The root cause and the resulting loss can belong to two different insurance conversations. Cyber insurance may address the compromise of the system. Environmental insurance may address the pollution conditions created by that compromise. These are two policies, that when placed in conjunction with one another will work, the key is that they both must be in place to respond to a claim.
That uncertainty is part of the point. We do not need to predict the exact scenario to recognize the insurance issue. In fact, some of the greatest environmental exposures are the ones we have not yet fully contemplated. The same principle applies to data centers, where there is growing discussion around water consumption, heat and noise, but where the long-term environmental consequences are still developing and, in some cases, difficult to quantify. The responsible approach is to understand the potential exposure, identify where traditional policies may stop responding, and consider whether environmental coverage can fill that uncertainty today. For organizations who are facing challenges with the funding, personnel, and training to secure critical infrastructure, insurance can be a financial and operational safety net.