AWWA calls for expanded federal cybersecurity support for U.S. water utilities following recent attacks on multiple systems
Executive summary: On August 5, 2026, AWWA sent a letter to U.S. Congressional leaders urging strong federal cybersecurity support for water utilities after recent cyberattacks impacted multiple water systems in several states. Water utilities are critical infrastructure; successful cyberattacks can disrupt safe water delivery, jeopardize public health, and erode public trust, necessitating coordinated federal intervention.
Who is involved: American Water Works Association (AWWA), U.S. Congressional leaders, U.S. Cybersecurity and Infrastructure Security Agency (CISA), U.S. Environmental Protection Agency (EPA), and affected water utilities.
Likely next: Congressional review of AWWA’s request, potential introduction of cybersecurity funding legislation, and increased federal agency coordination with water sector stakeholders.
The American Water Works Association (AWWA) has urged Congressional leaders to strengthen federal cybersecurity support for water utilities after a series of cyberattacks disrupted water services across several states. The appeal follows recent incidents that prompted CISA and EPA to issue protective action advisories. AWWA emphasizes the need for sustained funding, technical assistance, and coordinated response mechanisms to protect critical water infrastructure from evolving cyber threats.
Timeline
- — AWWA urges expanded U.S. cybersecurity support, measures (PR Newswire)
- — AWWA statement on recent cyber attacks on water systems (PR Newswire)
- — AWWA celebrates introduction of legislation to reauthorize SRFs, WIFIA (PR Newswire)
Analysis — what this means
Likely next events
- Congressional hearing on water sector cybersecurity expected by September 2026
- CISA to release updated guidance for water utilities by August 15, 2026
- EPA to assess funding needs under existing WIFIA and SRF programs by October 2026
Sectors affected
- Water utilities
- Critical infrastructure
- Public health services
Regulatory implications
- Potential expansion of CISA’s authority to mandate cybersecurity standards for water systems
- EPA may revise National Primary Drinking Water Regulations to include cybersecurity risk management
Historical parallels
- 2021 Oldsmar, Florida water treatment plant hack (unspecified chemical levels altered)
- 2023 ransomware attack on Atlantic County Utilities Authority (New Jersey)
- 2021 Colonial Pipeline cyberattack (fuel distribution disruption)
Key entities
Sources
- AWWA urges expanded U.S. cybersecurity support, measures — PR Newswire
- AWWA statement on recent cyber attacks on water systems — PR Newswire
- AWWA celebrates introduction of legislation to reauthorize SRFs, WIFIA — PR Newswire