Water Giant American Water Hit by Cyberattack

American Water, a big New Jersey-based company that provides water to over 14 million people, was recently hit by a cyberattack. The attack seemed to only affect their billing systems, as mentioned in a report they filed with the Securities and Exchange Commission on Monday. The company first found out about the attack on October 3rd. Luckily, the cyberattack didn't cause any problems with their water or wastewater services. No hacker group has claimed responsibility for the attack yet. American Water operates in 14 states and serves at least 18 military bases. In recent years, there's been a rise in cyberattacks against water facilities. Both states and criminals are taking advantage of the sector, which experts think is vulnerable. The White House has been warning about these vulnerabilities for a while now. They even sent a letter to the governors in March about the more than 170,000 water systems in the U.S.

The Environmental Protection Agency (EPA) has faced criticism for not doing enough to protect the water industry. The sector mostly relies on voluntary efforts for cybersecurity, which some people think needs to change. The Government Accountability Office pointed out that the EPA hasn't properly identified or prioritized the biggest risks in the sector as recently as August. To respond to the increasing threats, the EPA plans to step up water security inspections. A new plan also requires the government to share yearly updates on risk mitigation for critical infrastructure. Even though the attack on American Water didn't affect vital services, the company can't predict the full impact yet. They shut down some systems and took their billing services offline. Customers won't face late charges or have their water shut off while the company works to get back online. American Water is working with law enforcement to deal with the hack. In their 2023 annual report, the company mentioned spending $2.7 billion on capital investments and plans to invest $3.1 billion in 2024. They also highlighted their cybersecurity efforts, which include a "defense-in-depth" strategy based on the National Institute of Standards and Technology's framework.

Actions