American Water Reports Cyber Incident; Shuts Down Customer Portal

New Jersey-based American Water, which runs water treatment, transmission, wells and other water facilities for 14 states, has reported a cyber incident. The company has deactivated its customer portal, MyWater, as a precaution, but does not believe any of its water or wastewater facilities or operations have been negatively impacted by the incident.

The company said its water is safe to drink.

According to its report, American Water learned of unauthorized activity in its computer networks and systems on October 3, 2024.

Upon learning of the issue, the company said it immediately activated its incident response protocols and engaged third-party cybersecurity professionals to assist with containment, mitigation and an investigation into the nature and scope of the incident. The firm also notified law enforcement.

Taking the MyWater portal offline means the company is pausing billing until further notice and is working to bring these systems back online. There will be no late charges or services shut off while MyWater remains unavailable.

The company said its investigation is ongoing and will take time to complete. It said it is taking additional steps to strengthen its cybersecurity.

American Water operates as regulated utilities in approximately 1,700 communities in 14 states. Its primary operating assets include approximately:

• 80 surface water treatment plants
• 540 groundwater treatment plants
• 175 wastewater treatment plants
• 53,700 miles of transmission, distribution and collection mains and pipes
• 1,200 groundwater wells
• 1,700 water and wastewater pumping stations
• 1,100 treated water storage facilities
• 74 dams

It operates in the states of New Jersey, Maryland, Virginia, West Virginia, Pennsylvania, Georgia, Indiana, Tennessee, Kentucky, Missouri, Illinois, Iowa, Hawaii and California.