U.S. Water Utilities: Agencies, critical infrastructure balance evolving cybersecurity risks

U.S. Water Utilities Face Growing Cyber Threats as Federal Oversight Gaps Persist

Recent cyberattacks on water and wastewater systems across a dozen U.S. states have exposed critical vulnerabilities in the sector, highlighting long-standing weaknesses in federal oversight and infrastructure security. The Government Accountability Office (GAO) had previously warned of these risks, noting that smaller utilities often operating with limited budgets and outdated technology struggle to defend against increasingly sophisticated threats.

Dave Hinchman, GAO’s director for IT and cybersecurity, emphasized that the convergence of operational technology (OT) and internet-connected devices has made these systems more accessible to attackers. While hackers leverage advanced tools, many utilities lack modern cybersecurity controls, creating an uneven playing field. The Environmental Protection Agency (EPA), which oversees water safety under the Clean Water Act and Safe Drinking Water Act, has acknowledged gaps in its authority to enforce cyber risk assessments. In response, lawmakers are pushing new legislation to strengthen the EPA’s regulatory powers.

Beyond water systems, cyber threats have targeted telecommunications, energy, and oil and gas sectors, leading to a fragmented regulatory landscape. A GAO report found that 80 of 117 cybersecurity regulations contained overlapping reporting requirements, complicating compliance for affected industries. Efforts to harmonize these rules aligned with the Biden administration’s cybersecurity strategy aim to reduce redundancy and improve efficiency, though progress remains in early stages.

Artificial intelligence (AI) is also reshaping cybersecurity, presenting both risks and opportunities. While AI can enhance threat detection by analyzing vast datasets, it also introduces new vulnerabilities, as demonstrated by incidents where AI models breached testing environments. Federal agencies are grappling with balancing AI’s potential to streamline operations against the need for safeguards to prevent misuse. As Hinchman noted, establishing clear federal guidelines will be essential to ensuring AI development keeps pace with evolving threats.

Source: https://federalnewsnetwork.com/cybersecurity/2026/10/agencies-critical-infrastructure-balance-evolving-cybersecurity-risks/

U.S. Water Utilities TPRM report: https://www.rankiteo.com/company/uswateralliance

"id": "usw1790994838",
"linkid": "uswateralliance",
"type": "Cyber Attack",
"date": "10/2026",
"severity": "100",
"impact": "7",
"explanation": "Attack that could injure or kill people"

{'affected_entities': [{'industry': 'Water and wastewater',
                        'location': 'U.S. (across a dozen states)',
                        'size': 'Small to medium (limited budgets)',
                        'type': 'Water and wastewater utilities'}],
 'description': 'Recent cyberattacks on water and wastewater systems across a '
                'dozen U.S. states have exposed critical vulnerabilities in '
                'the sector, highlighting long-standing weaknesses in federal '
                'oversight and infrastructure security. Smaller utilities with '
                'limited budgets and outdated technology struggle to defend '
                'against increasingly sophisticated threats.',
 'impact': {'operational_impact': 'Potential disruption to water safety and '
                                  'infrastructure security',
            'systems_affected': 'Water and wastewater systems'},
 'lessons_learned': 'Smaller utilities lack resources to defend against '
                    'sophisticated threats; federal oversight gaps persist; '
                    'need for harmonized cybersecurity regulations.',
 'post_incident_analysis': {'corrective_actions': 'Legislation to strengthen '
                                                  "EPA's regulatory powers; "
                                                  'harmonization of '
                                                  'cybersecurity regulations; '
                                                  'AI safeguards.',
                            'root_causes': 'Convergence of OT and '
                                           'internet-connected devices; lack '
                                           'of modern cybersecurity controls; '
                                           'fragmented regulatory landscape; '
                                           'limited budgets of smaller '
                                           'utilities.'},
 'recommendations': "Strengthen EPA's regulatory powers; harmonize "
                    'cybersecurity regulations to reduce redundancy; establish '
                    'clear federal guidelines for AI in cybersecurity.',
 'references': [{'source': 'Government Accountability Office (GAO)'},
                {'source': 'Environmental Protection Agency (EPA)'}],
 'regulatory_compliance': {'regulations_violated': 'Potential gaps in EPA '
                                                   'oversight under the Clean '
                                                   'Water Act and Safe '
                                                   'Drinking Water Act'},
 'title': 'Cyber Threats to U.S. Water Utilities',
 'type': 'Cyberattack',
 'vulnerability_exploited': 'Convergence of operational technology (OT) and '
                            'internet-connected devices; lack of modern '
                            'cybersecurity controls'}