A cyberattack on American Water, the largest regulated water and wastewater utility company in the US, has sparked renewed concerns about safeguarding critical infrastructure. The New Jersey-based company revealed the cyberattack and paused customer billing as a precaution after discovering unauthorized activity. Although the incident prompted the shutdown of certain systems, water services for over 14 million people across 14 states and 18 military installations remained unaffected as protective measures were in place as of Wednesday.
American Water clarified that there was no evidence of the attack affecting its facilities or operations. However, the company’s staff are working tirelessly to investigate the incident further. Jack Danahy, the Vice President of Strategy and Innovation at NuHarbor Security, described the attack as more IT-focused than operational. This event highlights how infrastructure like water and wastewater services can also be vulnerable to cyber threats, especially as customer-facing services become more digitally accessible.
US agencies like the Cybersecurity and Infrastructure Security Agency and the Environmental Protection Agency have been urging water systems to enhance their cybersecurity measures to safeguard the nation’s drinking water. Recent inspections by federal officials revealed that around 70% of utilities inspected failed to meet the standards set to prevent breaches or intrusions, according to the EPA.
This cyberattack serves as a stark reminder of the importance of bolstering cybersecurity for critical infrastructure. As the investigation into the incident progresses, American Water and other utility companies may need to reassess and reinforce their cyber defenses to ensure the continuous delivery of essential services without disruptions.