Get Quartz in your inbox

Free daily briefing on global business news.

Why small-town utility companies are the most vulnerable to AI cyberattacks

Security rules make big power companies wall off the computers that run the grid. Most town utilities fall outside them, and hackers keep getting in

Chesnot / Getty Images

Nick Lawler, general manager of the public utility behind the power lines and water system in Littleton, Mass., hung up on the FBI agent who called in November 2023 to tell him Chinese government hackers were inside the utility's network. The agent called Lawler on a Friday at the start of Thanksgiving week and asked for Lawler's personal email address so the agent could send him a link. "It sounded like one of those Microsoft $MSFT scams," Lawler told The Register. He swore at the agent, refused to click the link, and hung up. Then he called the FBI's Boston office himself, and the same agent answered.

The hackers were Volt Typhoon, a group backed by the Chinese government. Lawler couldn't see why it would bother with a utility serving Littleton and neighboring Boxborough, two towns with about 15,000 people between them. "We don't own transmission. We're a distribution company. Yes, we're part of the overall grid, but the impact of taking out Littleton is small. You would never think that would be a target of any type of attack," he said.

The hackers got in through a flaw in a FortiGate firewall that its maker, Fortinet $FTNT, had fixed in December 2022, but the outside company Littleton paid to manage its computers never installed the fix. They had been inside for about 10 months by the time the FBI called, according to WaterISAC, a group that shares security information among water utilities. "I wouldn't say anything related to our substation or our engineering was compromised. They did access our servers," Lawler said. Sensors from the industrial security firm Dragos, which went onto the utility's equipment network in August 2023, had picked up traffic that didn't belong there, including communications with China, and once the FBI called, their logs showed when and where the hackers had moved. "That's when it became real for us," he told the American Public Power Association, which ran the government-funded program that paid for the sensors.

Littleton's break-in is the kind of attack that........

© Quartz