Britain's Financial Times on May 31 quoted an unidentified Western intelligence official as saying that the suspected goal of the Iranian cyberattack on Israel's water infrastructure facilities in late April was to manipulate the control systems into increasing the amount of chlorine added to the water supply.
The report said malicious code written by Iran was routed through US and European servers before reaching the pumping station control systems.
The official, whose government was said to have been briefed on the attack, said "It was close to successful, and it's not fully clear why it didn't succeed." The increase of the chlorine would have likely triggered an automatic shutdown of the pumping stations, cutting the water supply to tens of thousands of civilians and facilities, according to the official, who said hundreds of people would have been at risk of becoming ill.
The assault was also said to have set a precedent for cyberattacks on civilian infrastructure. Unnamed Israeli officials were quoted as saying that Israel retaliated by cyber-attacking Shahid Rajaee port in the Iranian city of Bandar Abbas.
The Financial Times report came several days after the acknowledgement by Yigal Unna, director-general of the Israel National Cyber Directorate, that the attack took place, marking the first time that an Israeli official had not only done so, but gave details about the incident.
In his speech on May 28 at the Cybertech Live Asia online conference, Unna said the highly “synchronized and organized attack” could have not only cut off water to the country's population in the middle of the coronavirus crisis, but also had harmful or even disastrous consequences by the addition of the wrong proportions of chemicals such as chlorine into the water. He said it was the first attack of its kind in history.
The senior official called the incident a turning point in cyber warfare, and warned that such attacks will only become more sophisticated and deadlier. "Cyber winter is coming, and coming even faster than I suspected," he said.
On May 19, the Washington Post reported that the cyberattack on the Iranian port earlier in the month was part of a cyber war between Israel and Iran, which Israel Defense had reported several days earlier.