After cyberattacks, AWWA encourages Congress to further support water sector

Water systems in at least seven U.S. states have been the target of cyberattacks in recent days, prompting renewed calls for federal support for the water sector.

“AWWA recognizes that improving the sector’s cybersecurity resilience is an evolving process, and that threat actors will continue to adapt and seek out vulnerabilities,” AWWA CEO David LaFrance wrote in a letter to Congressional leaders this week.

“We respectfully urge Congress to provide the support utilities have long needed for continued cybersecurity investment in their systems,” the letter said. “AWWA is ready and eager to continue serving as a partner and resource on water system cybersecurity.”

AWWA offers a range of cybersecurity resources, including its Getting Started Guide and an interactive cybersecurity assessment tool. These resources help utilities identify vulnerabilities, prioritize improvements, and strengthen resilience.

The letter expressed support for several cybersecurity measures included in the Senate’s recent Water Resources Development Act of 2026 (S. 4949), while also urging Congress to advance several bills to better equip utilities to address cybersecurity risks:

• Water Risk and Resilience Organization Establishment Act, which establishes an independent, nongovernmental organization to develop minimum cybersecurity requirements for the water sector with oversight by the U.S. Environmental Protection Agency.
• State and Local Cybersecurity Grant Program Reauthorization Act, which helps state and local governments address cybersecurity risks.
• Cybersecurity for Rural Systems Act, which expands the U.S. Department of Agriculture’s successful Circuit Rider Program to include cybersecurity.
• Protecting America from Cyber Threats Act, which reauthorizes the Cybersecurity Information Sharing Act of 2015 for an additional 10 years.

“Congress should act expeditiously to consider [these] additional measures to support the water sector,” the letter said.

The Federal Bureau of Investigation has reported that utilities in at least seven states were the target of cyberattacks in recent weeks, and media reports suggest that number may stretch beyond a dozen. Attacks target internet-connected operational technology devices, including programmable logic controllers, in an attempt to disrupt operations. Last month, U.S. officials warned of potential attacks from Iran-affiliated groups. (If you are an AWWA utility member, you received AWWA’s Utility Advisories noting such.)

AWWA’s “Beyond the Replacement Era” report calls out cybersecurity as a growing cost driver as drinking water utilities seek to meet $2.1-2.4 trillion in critical needs over the next 25 years while keeping water rates affordable.

“The recent cyberattacks on multiple U.S. water systems underscore the importance of remaining vigilant against evolving cyber threats,” LaFrance said in a public statement Aug. 4. “Water professionals understand their profound responsibility to protect the health, safety, and well-being of the communities they serve every day.

“Utilities across the water community are continually working to strengthen cybersecurity and improve resilience following cyberattacks,” he continued. “Success depends on access to timely threat intelligence, technical expertise, continual training, and the financial resources needed to secure critical systems.”