New York Hands $9 Million to 153 Water Utilities to Plug Cyber Gaps
The grants come as hackers step up attacks on water and wastewater systems across multiple US states. Here is what the money buys, and what it means for the people who drink the water.
Key points
- New York State awarded $9 million in cybersecurity grants to 153 water and wastewater systems in 2024.
- The funding targets assessment and improvement of digital defences at utilities serving local communities.
- A multistate campaign of attacks on water infrastructure has been running in the background, making the grants urgent.
- Water utilities are considered critical infrastructure, meaning a successful attack could disrupt safe drinking water for thousands of people.
New York State has given $9 million to 153 water and wastewater utilities to help them find and fix weaknesses in their computer systems. The grants, first reported by SecurityWeek, are a direct response to a wave of cyberattacks hitting water infrastructure across the United States.
Water systems run on software. Pumps, treatment processes, and pressure controls are all managed by computers, and those computers can be broken into just like any other.
Why are water systems under attack?
Criminals and state-sponsored hackers have been targeting water utilities because the stakes are high and the defences are often weak. A successful attack on a water treatment plant can threaten public health directly, which makes utilities attractive targets for groups trying to cause disruption or extract ransom payments.
US officials have been warning for months about a multistate campaign of intrusions, where attackers probe and sometimes break into the control systems that keep water safe to drink. Small and mid-sized utilities are especially exposed. They frequently run outdated software and lack dedicated cybersecurity staff.
What does the $9 million actually pay for?
The money covers two things: assessing what vulnerabilities, meaning weak points in a system's defences, already exist, and then fixing the most serious ones. That could mean updating ageing software, adding stronger login controls, or separating the networks that run treatment equipment from the networks staff use for email.
Here is a snapshot of the programme:
| Detail | Figure |
|---|---|
| Total grant funding | $9 million |
| Utilities receiving grants | 153 |
| Infrastructure type | Water and wastewater systems |
| Threat context | Active multistate attack campaign |
| Funding authority | New York State |
Should residents be worried?
There is no indication that any New York utility has suffered a disruptive attack as a result of the campaign described. The grants are a precautionary measure, not a response to a confirmed breach. That said, the threat is real and ongoing.
If you get your water from a municipal supplier, you do not need to do anything different today. Water utilities are required to report incidents that affect public health. If something goes wrong, your local authority will notify you and give specific guidance.
Stay alert to any official notices from your local water provider, and take them seriously if they arrive.
Common questions
Could a cyberattack actually poison the water supply?
It is technically possible, but difficult. Modern plants have physical safeguards that are independent of their computer systems. A 2021 attempt to tamper with chemical levels at a Florida water plant was caught quickly by an operator watching the screen.
Does this affect private well owners?
No. These grants cover utilities that supply water to homes and businesses through a municipal network. Private well owners are not part of the programme and manage their own supply independently.
