American Water, the largest regulated water and wastewater utility in the U.S. revealed on Monday that it had suffered a cyberattack, leading to a temporary suspension of customer billing.
Headquartered in New Jersey and serving over 14 million customers across 14 states and 18 military bases, the utility said in a security statement on its website that it detected unauthorized activity last Thursday, which it identified “to be a result of a cybersecurity incident.”
In response, the company took immediate protective measures, including shutting down its customer service portal, which meant the company had to pause its billing function: “we are pausing billing until further notice.” Additionally, customers will not incur late fees while the systems are down.
American Water stated that its facilities and operations remain unaffected and that the water remains safe to drink, and its team is working tirelessly to assess the situation.
The company has informed law enforcement about the incident and is collaborating with them during the investigation.
The surge in cybercrime aimed at critical water infrastructure prompted the Environmental Protection Agency (EPA) to release an enforcement alert, highlighting that 70% of the water systems it inspected fail to meet the standards outlined in the Safe Drinking Water Act. While the EPA did not provide specific numbers, it noted that many systems have "alarming cybersecurity vulnerabilities," including outdated default passwords, insecure single login configurations, and former employees still having access to systems.
American Water operates more than 500 water and wastewater systems in around 1,700 communities across various states, including California, Georgia, Hawaii, Illinois, Indiana, Iowa, Kentucky, Maryland, Missouri, New Jersey, Pennsylvania, Tennessee, Virginia, and West Virginia.American Water operates more than 500 water and wastewater systems in around 1,700 communities across various states, including California, Georgia, Hawaii, Illinois, Indiana, Iowa, Kentucky, Maryland, Missouri, New Jersey, Pennsylvania, Tennessee, Virginia, and West Virginia.
