American Water Works Company Discloses Cybersecurity Incident

American Water Works Company, Inc. (AWK), one of the largest water and wastewater utilities in the United States, reported unauthorized activity within its computer networks due to a cybersecurity incident.

Upon discovery, on October 3, the company quickly implemented incident response protocols, activated third-party cybersecurity experts for containment and mitigation, and notified law enforcement. While the company believes that its water or wastewater facilities and operations remain unaffected, the full scope and impact of the incident are still under investigation.

American Water Works, headquartered in Camden, New Jersey, provides essential water and wastewater services to approximately 14 million people in 24 U.S. states. Given its broad customer base and its role as a critical infrastructure provider, cybersecurity breaches have the potential to affect millions of individuals and disrupt essential services. However, in this case, AWK has stated that no immediate impact on water treatment or distribution operations has been detected.

After detecting the breach, AWK promptly took measures to secure its systems by disconnecting or deactivating parts of its network as needed. These actions are standard in cybersecurity to prevent further unauthorized access while an investigation is ongoing. The company enlisted third-party cybersecurity experts to understand the nature of the incident, identify vulnerabilities, and ensure the continued security of its systems. AWK is also coordinating with law enforcement authorities as part of the response process.

Although the current belief is that the cyber incident will not materially affect the company's operations, financial condition, or results, AWK emphasizes that its ongoing investigation could reveal additional information or necessitate further actions. The company has not disclosed the specifics of the unauthorized activity, such as whether it involved ransomware, data theft, or another form of cyberattack.

The nature of AWK’s services makes them prime targets for cyberattacks, which can range from data breaches to ransomware incidents that aim to disrupt essential operations. Given the dependence of millions of people on these services, such attacks can have wide-reaching effects on public health, safety, and economic stability.

Water utilities, in particular, are critical to public health, and disruptions in water distribution or wastewater treatment can lead to public health crises or environmental disasters. Cyberattacks on water infrastructure can compromise water safety, service reliability, and public trust, making the security of these systems a matter of national importance.