Targeted Email Account Compromise Phishing Incidents Continue Against U.S. Water and Wastewater Utilities

The EPA and WaterISAC are aware that multiple water utilities have reported targeted phishing emails being sent to their employees during the past week and would like to remind all members and sector partners to implement recommended mitigations, including end user awareness and education to combat this threat. 

The emails have attempted to impersonate current employees or government officials and have utilized official logos to give the phishing emails the appearance of legitimacy. These reports, along with responses to WaterISAC’s Quarterly Incident Surveys, corroborate that water and wastewater systems of all sizes continue being victimized by impersonation-style attacks such as Business Email Compromise, and specifically Vendor Email Compromise (VEC).