Beyond the faucet: technology that safeguards your drinking water

April 29, 2025

Have you ever stopped to think about what it means to have clean drinking water when you turn on the tap? Access to safe and continuous drinking water was a privilege not so long ago. Now we know it is one of the most important innovations in history.

With a background in smart water quality solutions, Libelium is innovating in cybersecurity to protect water infrastructures with innovative solutions that keep water flowing without interruption, as we always have.

Critical infrastructure for drinking water

We take it for granted, but behind the straightforward act of turning on the tap, there is a network of infrastructures more interconnected and digitised than ever before. There are invisible threads to ensure it works, as cybersecurity is key.

For example, Drinking Water Treatment Plants are responsible for transforming raw water into drinking water, removing contaminants and ensuring that it is fit for human consumption. Wastewater Treatment Plants play a crucial role in treating used water, returning it safely to the environment or, in some cases, reusing it for other purposes.

In regions where fresh water is scarce, desalination plants take centre stage by transforming salt water into drinking water, which represents a fundamental advance for these areas’ survival and economic development.

These infrastructures provide drinking water and also impact sustainability through water reuse and responsible management, aiding aquatic ecosystems and reducing water scarcity.

In addition, the distribution and storage systems, consisting of pumps, tanks and valves, make up an interconnected network that ensures that water flows continuously to all households, businesses and sectors, keeping the water cycle running efficiently.

This cycle, from catchment, treatment and distribution to purification and reuse, is essential to ensure a constant and sustainable supply of water, which is crucial for the global economy. Without clean and accessible water, agriculture, industry and daily life would be severely affected.

Using technologies such as OT (Operational Technology) and SCADA allows all these systems to work in a coordinated and efficient manner, ensuring that water resources are appropriately managed. It is, therefore, essential to strengthen the cybersecurity of these systems.

Actual threats to water infrastructure cybersecurity

In recent years, water supply infrastructures have become a frequent target of cyberattacks. In American Water, the largest water and wastewater utility in the United States, cybercriminals forced the company to take several key systems offline, including its billing platform. Although water treatment and water quality operations were unaffected, the incident highlighted vulnerabilities in the industry’s critical infrastructure.

In addition, a common attack affecting this type of infrastructure is ransomware, in which cybercriminals lock down systems and demand a ransom to free them. Recently, UK water utility Southern Water confirmed that a group of cyber criminals had accessed its systems and stolen data. Although the company indicated that neither its customer relations nor financial systems were affected, the incident highlights the growing threat facing water infrastructures.

In this case, the cybercriminals stole 750 GB of data, including personal information and corporate documents. Although Southern Water’s services continued to operate normally, the attack highlights the urgent need to improve cyber security in the sector, as many water infrastructures still face risks due to a lack of modern security measures and the expansion of vulnerable areas.

Libelium leads a cybersecurity project for INCIBE

The digitisation of the water sector has increased the need to protect the critical infrastructures that guarantee a safe and healthy drinking water supply. Libelium is leading the European project TRUEDATA (Secure and Reliable Traceability of Water Infrastructure Data), with a clear objective: to strengthen the digital resilience and protection of our country’s critical water infrastructures. How do we do it?

Artificial Intelligence: We designed algorithms to detect unusual patterns in network traffic and operational data. This involves integrating AI into the central water quality and distribution management planning servers. If something is not working as it should, the system can alert before it becomes a serious problem.

OT/SCADA protection: This is where a key component, the network sniffer, comes into play. A sniffer is a tool that captures and analyses the data packets circulating in industrial networks (OT/SCADA). The sniffer captures data and provides crucial information for AI algorithms to identify standard traffic patterns and detect anomalies that could indicate an attack or failure. This detailed analysis helps to anticipate potential threats and ensure the integrity and availability of water systems before a significant incident occurs. The tool has captured over 30 million data collected in 4 months to feed and train the AI.

Blockchain: Finally, every significant event is recorded in a way that cannot be modified, ensuring traceability, transparency and, above all, information security.

The combination of advanced detection, efficient response and secure event storage puts the solution at the forefront of cyber protection for critical infrastructure in the water sector. AirTrace Technologies, Neoradix, the Catholic University of Murcia (UCAM), and BERSEY also collaborate on the project.

This project, which stems from a Public Procurement of Innovation, is being tested in the water facilities of Campotéjar (Murcia) and ESAMUR (Molina de Segura) as well as in the CHS itself.

Pioneering the future: the Cyber Resilience Act (CRA)

We are not just reacting to today’s threats; we are preparing for tomorrow’s regulations. The European Union’s Cyber Resilience Act (CRA) is set to revolutionize product security, becoming fully applicable in 2027.

Libelium is using the TRUEDATA project as a real-world validation case to benchmark compliance against these strict new EU standards. In a recently published scientific study, “Integrating the CRA into the IoT Life Cycle“, the TRUEDATA architecture was rigorously audited against CRA mandates.

The study highlighted that our approach creates a robust technical foundation for compliance through:

Secure-by-design principles: Embedding security from the very first phase of the product lifecycle.
End-to-End Data Integrity: Using encrypted and instrumented data paths from the sensor to the cloud.
Continuous Monitoring: Moving beyond static checks to dynamic, AI-driven surveillance of the water infrastructure.

By aligning TRUEDATA with the CRA now, Libelium is proving that critical water infrastructure can be not only secure but also fully compliant with the most advanced regulatory frameworks in the world.

Why can Libelium lead this project for critical infrastructure?

Libelium has extensive experience in providing smart solutions for water quality monitoring. The latest project in which we are involved is the digitisation of the Panama Canal, which aims to create a digital twin to enable more efficient management of this strategic enclave of world trade.

With every installation, we learn and improve. Our goal is clear: no water infrastructure should be left unprotected. At Libelium, technology must be at the service of a safer, more humane and sustainable future. And that future is built, drop by drop, with innovation, collaboration and responsibility.

The importance of cyber security in critical infrastructure

Cyber-attacks on energy utilities have tripled in the last four years and have become more sophisticated due to AI. At the same time, AI is becoming a critical tool for energy companies to engage against such attacks. Another energy security concern relates to the growing demand for essential minerals used in equipment in data centres that power AI.

Behind the Change.

Beyond the Challenge.