America’s Largest Water Utility Faces Cyberattack Amid Rising Threats to Infrastructure
American Water, the largest water utility in the United States, has disclosed that it recently experienced a significant cyberattack. Based in Camden, New Jersey, the company announced in a security statement on its website that it detected “unauthorized activity in our computer networks and systems” last Thursday, which it confirmed to be a result of a cybersecurity incident.
In response to this breach, American Water has temporarily shut down its customer service portal, which has halted billing functions “until further notice.” The utility has assured its customers that no late fees or other charges will be applied during this downtime, emphasizing its commitment to transparency and customer care.
Increasing Cyber Threats to U.S. Infrastructure
This incident comes at a time when cyberattacks against critical U.S. infrastructure are on the rise. Recent breaches have severely disrupted services for major companies, such as the hack against UnitedHealth, which caused widespread issues for patients needing prescriptions and healthcare providers seeking payments for their services.
Water utilities, in particular, have become prime targets for cybercriminals, with attacks attributed to geopolitical adversaries like Iran, Russia, and China. Foreign-linked cybercriminals prioritize disabling critical national infrastructure, a trend that poses a growing risk to drinking water and wastewater systems across the country. An Environmental Protection Agency (EPA) spokesperson recently noted, “All drinking water and wastewater systems are at risk — large and small, urban and rural.”
American Water’s Impact and Response
American Water provides essential drinking water and wastewater services to over 14 million people across 14 states and 18 military installations. The scale of this utility underscores the importance of maintaining robust cybersecurity measures. A notable incident earlier this year involved a Russian-linked cyberattack on a water filtration plant in Muleshoe, Texas, near a U.S. Air Force base. Experts in the field, like Adam Isles from Chertoff Group, highlighted that the water sector is among the least mature in terms of cybersecurity preparedness.
The FBI warned Congress earlier this year that Chinese hackers had infiltrated U.S. cyber infrastructure, targeting vital systems, including water treatment facilities, the electrical grid, and transportation networks. The continued targeting of these critical areas illustrates the urgent need for enhanced cybersecurity protocols across all sectors.
Current Investigation and Safety Assurance
American Water has stated that it is still early in the investigation into this cyberattack and currently believes that there has been no impact on water or wastewater facilities. The company reassured the public that the water remains safe to drink. Involving law enforcement and third-party cybersecurity experts, American Water aims to understand the full scope of the breach and secure its systems against future threats.
The EPA has issued an enforcement alert highlighting alarming cybersecurity vulnerabilities across the nation’s water systems. According to their findings, 70% of inspected water systems do not fully comply with the requirements set forth in the Safe Drinking Water Act. Many of these systems are operating with default passwords that have not been updated, vulnerable single login setups, and unauthorized access retained by former employees.
American Water’s recent cyberattack underscores the pressing need for improved cybersecurity across the nation’s water infrastructure. As the threat landscape continues to evolve, utilities must prioritize robust security measures to protect vital resources. The company’s proactive communication and ongoing investigation reflect a commitment to safeguarding customer data and maintaining public trust during this challenging time.
As this situation develops, it serves as a critical reminder of the vulnerabilities that exist within essential services and the importance of vigilance in protecting our infrastructure.