New York Hands $9 Million to 153 Water Utilities to Plug Cyber Gaps
The grants come as hackers step up attacks on water and wastewater systems across multiple US states. Here is what the money buys, and what it means for the people who drink the water.
Key points
- New York State awarded $9 million in cybersecurity grants to 153 water and wastewater systems in 2024.
- Funding targets assessment and improvement of digital defences at utilities serving local communities.
- An active multistate attack campaign against water infrastructure makes the timing urgent.
- A successful attack could disrupt safe drinking water for thousands of people.
New York State has given $9 million to 153 water and wastewater utilities to find and fix weaknesses in their computer systems. The grants, first reported by SecurityWeek, respond directly to a wave of cyberattacks hitting water infrastructure across the United States. We covered the suspected Iranian-linked attack on more than 30 Minnesota water utilities on 26 and 27 July, where automated controls were knocked out and one city briefly shut its plant down entirely.
Water systems run on software. Pumps and treatment controls are all managed by computers, and those computers can be broken into like any other.
Why are water systems under attack?
Criminals and state-sponsored hackers target water utilities because the defences are often weak and the consequences of disruption are immediate and public. A successful attack on a treatment plant can threaten public health directly, which makes utilities attractive to groups seeking ransom payments or wanting to cause disruption.
Small and mid-sized utilities are especially exposed. They frequently run outdated software and lack dedicated cybersecurity staff.
What does the $9 million actually pay for?
The money covers two things: assessing what vulnerabilities (weak points in a system's defences) already exist, then fixing the most serious ones. That could mean updating ageing software, adding stronger login controls, or separating the networks running treatment equipment from those staff use for email.
Here is a snapshot of the programme:
| Detail | Figure |
|---|---|
| Total grant funding | $9 million |
| Utilities receiving grants | 153 |
| Infrastructure type | Water and wastewater systems |
| Threat context | Active multistate attack campaign |
| Funding authority | New York State |
Should residents be worried?
No New York utility is known to have suffered a disruptive attack from the campaign described. The grants are precautionary. The threat, though, is real: investigators are still working out whether Iranian-linked actors were responsible for the Minnesota incidents, as our 3 August report on the attribution question laid out.
If you get your water from a municipal supplier, you don't need to do anything different today. Utilities are required to report incidents affecting public health. If something goes wrong, your local authority will notify you with specific guidance.
Common questions
Could a cyberattack actually poison the water supply?
It's technically possible, but hard to pull off. Modern plants have physical safeguards independent of their computer systems. A 2021 attempt to tamper with chemical levels at a Florida water plant was caught quickly by an operator watching the screen.
Does this affect private well owners?
No. These grants cover utilities supplying water through a municipal network. Private well owners manage their own supply independently and aren't part of the programme.
