American Water Works, the largest regulated water and wastewater utility in the United States, reported a cyberattack on Monday, Oct. 7. The breach impacted more than 14 million customers across 14 states and 18 military installations.
The Camden, a New Jersey-based company, said it detected unauthorized activity within its computer networks on Oct. 3, prompting immediate protective measures, including shutting down certain systems to contain the breach.
American Water emphasized that its water and wastewater operations were not affected by the attack. However, the company paused its billing systems as a precaution and assured customers they will not face late fees while the systems are offline.
The company is working with third-party cybersecurity experts and law enforcement to investigate the incident and determine its full scope.
In a regulatory filing, American Water said it could not yet predict the full impact of the breach but it does not expect the incident to materially affect its financial condition or operations. The company operates more than 500 water and wastewater systems in about 1,700 communities.
The cyberattack comes as U.S. officials express increasing concern over vulnerabilities in critical infrastructure. Recently, U.S. authorities warned of foreign actors, including Chinese intelligence services, targeting sectors like water treatment facilities and broadband providers.
American Water has not disclosed the source of the attack. The incident, however, adds to growing concerns about cybersecurity threats to essential utilities.
