Kansas man indicted in connection with 2019 hack at water utility
A U.S. grand jury has indicted a 22-year-old man for allegedly hacking the computer system of a rural water utility in Kansas and shutting down processes that affect procedures for cleaning and disinfecting water.
Federal prosecutors allege in an indictment unsealed Wednesday that Wyatt Travnichek logged into Ellsworth County Rural Water District’s computer system in 2019 as part of an “unauthorized remote intrusion” that resulted “in the shut-down of the facility’s processes.” Travnichek is accused of tampering with a water system, and causing “reckless damage to a protected computer.” The charges carry maximum prison sentences of 20 years and five years, respectively.
Angela Naegele, a customer service specialist at the water utility who answered the phone Thursday, said the 2019 incident had no impact on customers’ drinking water. The utility continuously monitors its water quality and safety, Naegele added.
The facility serves Ellsworth County, a county of about 6,100 people in central Kansas.
The indictment did not specify whether Travnichek allegedy circumvented any security controls in his alleged break-in. Prosecutors cited the Safe Drinking Water Act, a 1974 law that mandates contamination-free standards for U.S. water systems, in bringing the charges.
An attorney for Travnichek could not be reached for comment on Thursday.
Travnichek’s indictment comes two months after another high profile digital intrusion into a water treatment facility near Tampa, Florida. In that incident, an unidentified hacker used a remote software program to breach the facility’s computer system, and temporarily changed the plant’s sodium hydroxide setting to a potentially dangerous level, according to local authorities. A plant operator noticed and reversed the change.
There was no harm to public health, local authorities said.
The Florida incident was emblematic of a water sector that’s short on money and cybersecurity personnel, and often reliant on the practices of vendors, experts have told CyberScoop.
The full indictment against Travnichek is available online.
