Understanding the Risks of Cyberattacks on Critical Infrastructure

Recent cyberattacks on water systems in several states underscore serious risks to cyber physical systems supporting critical infrastructures. Although cyberattacks are so frequent that they generally go unnoticed unless they cause direct impact, they present significant threats.

In 2024, there were over 859,000 cyberattacks, averaging nearly 100 per hour. These attacks resulted in financial losses of almost $17 billion, a substantial increase from $2.7 billion in 2018. Among these attacks, nearly 4,900 targeted critical infrastructures essential for our economy.

A notable incident occurred in May 2025 when Canvas, a learning management system used widely in education and corporate training, suffered a ransomware cyberattack. This affected millions, highlighting vulnerabilities in centralized data management systems.

Cyberattacks shine light on how centralized data systems can disrupt critical infrastructure, affecting services like air travel, which impacts over 2.5 million people daily.

Air travel relies heavily on centralized data management—for ticket processing, crew scheduling, and ground operations. The passenger service system, including airline reservation systems, manages the entire lifecycle of air passengers. Though centralization makes air travel efficient, it also increases its vulnerability to cyberattacks.

In 2025, cyberattacks disrupted air travel at several European airports, necessitating manual processing of travelers. Such manual methods for handling 2.5 to 3 million daily passengers in the U.S. could halt the air system and complicate Transportation Security Administration checks, weakening aviation security.

Even non-malicious disruptions show vulnerabilities, like the American Airlines computer outage on July 28. Similarly, the CrowdStrike software update bug in July 2024 affected Windows systems, forcing airlines to revert to manual check-ins and paper tickets. Delta Airlines alone faced a $500 million loss from this disruption, underscoring the impact of centralized data system disruptions even without malicious intent.

Numerous critical infrastructures leverage centralized or hybrid management systems, ensuring efficient oversight but also increasing susceptibility to cyberattacks, potentially disrupting the digital economy. For instance, while the Federal Reserve operates across 12 banks nationwide, many transactions are interconnected, forming a hybrid centralized structure. Compromise in any segment could slow financial activities.

Centralization boosts efficiency but also introduces vulnerabilities. Balancing these benefits and risks is crucial in designing complex systems. Our digital economy often reaps frequent benefits, and risk minimization typically prevents severe outcomes. Yet, as seen with Canvas, adverse effects can still arise, exemplifying costs associated with a connected economy.

Rare events, though infrequent, are highly disruptive and expensive when they occur. With critical digital infrastructures, such events can be debilitating.

Sheldon H. Jacobson, Ph.D., Professor of Computer Science at the University of Illinois Urbana-Champaign, specializes in data-driven risk-based decision-making for public policy.