Foreign hackers apparently attacked a water plant control system in Illinois, reportedly in Curran-Gardner Townships Public Water District, in the first reported case of a malicious cyber attack on a computer control system for a piece of critical infrastructure. [Update: It has now been confirmed that this was not a cyber attack at all. The whole story can be read here.]

According to a Washington Post story, the control system for the water pumps had been experiencing disruptions for two to three months. Eventually one of the pumps burned out after the system was made to repeatedly turn on and off. An investigation by an IT services and computer repair company discovered through the system logs that the Supervisory Control and Data Acquisition Systems (SCADA) of the water utility had been hacked from a computer located in Russia, according to a report from the Illinois Statewide Terrorism and Intelligence Center quoted by computer security expert Joe Weiss.

While the utility had multiple water pumps and customers suffered no interruptions of service or adverse effects on their water supply, the precedent has now been set for attacks on critical U.S. infrastructure. Experts have been warning of the vulnerability of critical infrastructure elements in the United States, including nuclear plants, water utilities, refineries, the electrical power grid, and more, for some time.

The drumbeat for increased security only increased after the Stuxnet virus was introduced into Iranian computers to temporarily cripple the country’s efforts to produce nuclear weapons. If such a virus could be introduced to the SCADA of the Iranian plant’s computers, which were under extremely tight security, experts argued, it could easily be introduced into the computers of SCADA systems used by municipalities or private firms, experts warned.

DHS Spokesman Peter Boogaard would not confirm that the utility suffered a cyber attack, but acknowledged an ongoing investigation by Department of Homeland Security and the FBI.

“DHS and the FBI are gathering facts surrounding the report of a water pump failure in Springfield, Ill. At this time there is no credible, corroborated data that indicates a risk to critical infrastructure entities or a threat to public safety,” Boogaard said in an emailed statement.

As has been reported here at Defense Media Network and elsewhere, however, such a cyber attack, while long expected, would constitute a game-changer for U.S. cybersecurity.