AWWA warns water utilities to bolster defenses after a spate of cyberattacks on U.S. water systems
Executive summary: AWWA released a statement following CISA and EPA alerts that a series of cyberattacks have disrupted water services in several U.S. states over the last two weeks. The attacks threaten public health and service continuity, potentially driving up emergency response costs and prompting stricter regulatory requirements for water utilities.
Who is involved: AWWA, U.S. Cybersecurity and Infrastructure Security Agency (CISA), U.S. Environmental Protection Agency (EPA), and affected water utilities across multiple states.
Likely next: Water utilities will implement the recommended protections; CISA and EPA may issue further guidance or mandatory cyber‑risk assessments, and Congress could consider funding for infrastructure cyber resilience.
The American Water Works Association (AWWA) issued a statement urging immediate protective actions after CISA and the EPA warned that several water services across multiple states have been hit by cyberattacks over the past two weeks. The advisory highlights the growing vulnerability of critical water infrastructure to digital threats and signals a likely increase in federal oversight and utility‑level cybersecurity spending.
Timeline
- — AWWA statement on recent cyber attacks on water systems (PR Newswire)
Analysis — what this means
Likely next events
- CISA to publish an updated cybersecurity checklist for the water sector by mid‑August 2026
- EPA to evaluate mandatory cyber risk assessments for water systems by Q4 2026
- AWWA to convene a national water‑utility cybersecurity summit in September 2026
Sectors affected
- Water utilities
- Municipal water services
- Critical infrastructure
Regulatory implications
- CISA/EPA joint guidance could become enforceable under the Safe Drinking Water Act
- Possible adoption of a NIST Cybersecurity Framework overlay for water by 2027
Historical parallels
- 2021 Colonial Pipeline ransomware attack that disrupted fuel supplies
- 2020 Oldsmar, Florida water treatment plant hack where attackers attempted to poison the water supply
Key entities
Sources
- AWWA statement on recent cyber attacks on water systems — PR Newswire