American Water says it was hit with cyberattack<\/title> <meta name=\"description\" content=\"The company, which provides water to 14 million people, says there does not appear to be any impact to water services.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/american-water-works-cyber-ransomware\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"American Water says it was hit with cyberattack\"> <meta property=\"og:description\" content=\"The company, which provides water to 14 million people, says there does not appear to be any impact to water services.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/american-water-works-cyber-ransomware\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2024-10-07T17:57:36+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/major-u-s-water-company-hit-by-cyberattack-2.jpg\"> <meta property=\"og:image:width\" content=\"1280\"> <meta property=\"og:image:height\" content=\"720\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"Christian Vasquez\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:title\" content=\"American Water says it was hit with cyberattack\"> <meta name=\"twitter:description\" content=\"The company, which provides water to 14 million people, says there does not appear to be any impact to water services.\"> <meta name=\"twitter:creator\" content=\"@chrismvasq\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1725982252g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1727795050g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1728062720g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=ada0ad45b21fc79c6694\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/82041\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.6.2\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=82041\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Famerican-water-works-cyber-ransomware%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Famerican-water-works-cyber-ransomware%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-82041 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/american-water-works-cyber-ransomware\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--event js-stickybar\">\n<div class=\"stickybar__details\" readability=\"4.952380952381\">\n<div class=\"stickybar__info js-sticky-bar-content\" readability=\"32\">\n<p>Voting is open for the 2024 CyberScoop 50 awards! <\/p>\n<\/div>\n<p> <a class=\"stickybar__link button button-tertiary\" href=\"https:\/\/cyberscoop.com\/cyberscoop50\/vote\/\">Click here!<\/a> <\/div>\n<p> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"23.787234042553\">\n<div class=\"single-article__header-content\" readability=\"27.733333333333\">\n<p> American Water Works Company said there does not appear to be any impact to water services. <\/p>\n<p>   <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"360\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/major-u-s-water-company-hit-by-cyberattack.jpg?resize=640%2C360&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt=\"American Water Headquarters\" decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/major-u-s-water-company-hit-by-cyberattack-2.jpg 1280w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/major-u-s-water-company-hit-by-cyberattack-2.jpg?resize=300,168 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/major-u-s-water-company-hit-by-cyberattack-2.jpg?resize=768,432 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/major-u-s-water-company-hit-by-cyberattack-2.jpg?resize=1024,576 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/major-u-s-water-company-hit-by-cyberattack-2.jpg?resize=600,337 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/major-u-s-water-company-hit-by-cyberattack-2.jpg?resize=1200,675 1200w\" sizes=\"(max-width: 1200px) 100vw, 1200px\"><figcaption> American Water headquarters in Camden, New Jersey. (Photo by Ajay Suresh \/ https:\/\/flic.kr\/p\/2pC3JsS) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"29.295906601326\"><body readability=\"59.605809128631\"><\/p>\n<p>A New Jersey-based company responsible for providing water to more than 14 million people was hit by a cyberattack which appears to only resulted in the loss of billing systems, according to a Securities and Exchange Commission filing Monday.<\/p>\n<p>American Water Works Company, which<a href=\"https:\/\/www.sec.gov\/Archives\/edgar\/data\/1410636\/000119312524233300\/d869346d8k.htm\"> first learned of the attack<\/a> on Oct. 3, said there does not appear to be any impact to water or wastewater services. No ransomware gang has claimed responsibility for the attack on the company, which has operations in 14 states and serves at least 18 military installations.<\/p>\n<p>There has been a steady increase in cyberattacks against water facilities in recent years, as both states and criminals exploit the sector, which experts deem vulnerable. The White House has spent many months warning about the vulnerabilities of the more than 170,000 water systems in the United States, including by sending a <a href=\"https:\/\/cyberscoop.com\/epa-water-threats-governors\/\">letter to governors<\/a> in March.<\/p>\n<p>At the same time, the Environmental Protection Agency has faced heavy criticism for the sector\u2019s vulnerability, as the industry has faced a rash of hacks against water facilities. Meanwhile, the sector continues to be a <a href=\"https:\/\/cyberscoop.com\/epa-water-cyber-regulations\/\">largely voluntary operation<\/a> when it comes to cybersecurity efforts, which critics say is dependent on Congress revamping EPA\u2019s authorities. The Government Accountability Office has also noted as recently as August that the EPA has not <a href=\"https:\/\/cyberscoop.com\/epa-water-cyber-gao-report\/\">identified or prioritized the greatest risks<\/a> in the sector.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>The EPA has announced plans to <a href=\"https:\/\/cyberscoop.com\/epa-water-inspections-cyber-alert\/\">increase water security inspections<\/a> in response to the increasing threats. Additionally, a recent reboot of a <a href=\"https:\/\/cyberscoop.com\/biden-national-security-memorandum-critical-infrastructure\/\">landmark critical infrastructure policy<\/a> will require the government to provide yearly risk mitigation updates through a <a href=\"https:\/\/www.cisa.gov\/news-events\/news\/plan-protect-critical-infrastructure-21st-century-threats\">national plan on infrastructure risk<\/a>.<\/p>\n<p>While the American Water hack does not appear to impact vital services or operations, the company noted that it is \u201cunable to predict the full impact of this incident\u201d and disconnected some systems. The 8-K filing also notes that American Water does not expect the hack to have a \u201cmaterial effect on the company, or its financial condition or results of operations.\u201d<\/p>\n<p>The company took billing services offline and <a href=\"https:\/\/amwater.com\/corp\/security-faq\">noted on its website<\/a> that customers will not incur late charges and water services will not be shut off while they work to get back online.<\/p>\n<p>The company said in a statement to CyberScoop that it had \u201ccontacted and [is] receiving assistance from law enforcement, and we are coordinating fully with them.\u201d<\/p>\n<p>In its 2023 <a href=\"https:\/\/s26.q4cdn.com\/750150140\/files\/doc_financials\/2023\/ar\/american-water-2023-annual-report.pdf\">annual report<\/a>, American Water wrote that the company\u2019s \u201ccapital investment totaled $2.7 billion, and we are well on track to deliver $3.1 billion in investments in 2024.\u201d<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>The annual report also included a section on the company\u2019s cybersecurity effort, highlighting a \u201cdefense-in-depth\u201d strategy that uses the National Institute of Standards and Technology\u2019s cybersecurity framework. The company \u201cperiodically reviews and modifies the implementation of its cybersecurity strategy based on threat trends, program maturity, the results of assessments, and the advice of third-party security consultants,\u201d per the report.<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"1.510447761194\">\n<div class=\"author-card\" readability=\"9\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/major-u-s-water-company-hit-by-cyberattack-1.jpg?w=640&ssl=1\" alt=\"Christian Vasquez\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by Christian Vasquez<\/h4>\n<p> Christian covers industrial cybersecurity for CyberScoop News. He previously wrote for E&E News at POLITICO covering cybersecurity in the energy sector. Reach out: christian.vasquez at cyberscoop dot com <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Geopolitics<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/american-water-works-cyber-ransomware\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>American Water says it was hit with cyberattack Skip to<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[413,859,281,873,288,1066],"tags":[415,862,285,875,294,1067],"class_list":["post-5651","post","type-post","status-publish","format-standard","hentry","category-critical-infrastructure","category-environmental-protection-agency-epa","category-hacking","category-ics","category-threats","category-water-sector","tag-critical-infrastructure","tag-environmental-protection-agency-epa","tag-hacking","tag-ics","tag-threats","tag-water-sector"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/critical-infrastructure\/\" rel=\"category tag\">critical infrastructure<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/environmental-protection-agency-epa\/\" rel=\"category tag\">Environmental Protection Agency (EPA)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/hacking\/\" rel=\"category tag\">hacking<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/ics\/\" rel=\"category tag\">ics<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/threats\/\" rel=\"category tag\">Threats<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/water-sector\/\" rel=\"category tag\">water sector<\/a>","tag_info":"water sector","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/5651","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=5651"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/5651\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=5651"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=5651"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=5651"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":5651,"date":"2024-10-07T12:57:36","date_gmt":"2024-10-07T17:57:36","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=82041"},"modified":"2024-10-07T12:57:36","modified_gmt":"2024-10-07T17:57:36","slug":"major-u-s-water-company-hit-by-cyberattack","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/10\/07\/major-u-s-water-company-hit-by-cyberattack\/","title":{"rendered":"Major U.S. water company hit by cyberattack"},"content":{"rendered":"