Senate hearing warns of cyberattacks on U.S. water systems

Last week, a Senate committee held a hearing to address rising cyberattacks on U.S. drinking water and wastewater systems, which pose threats to communities nationwide. 

What they’re saying: “Because of the important role our water systems play in our country, they are unfortunately a target for bad actors,” said Sen. Shelley Moore Capito, Chair of the Senate Environment and Public Works Committee. 

• “For example, ransomware attacks can compromise business or customer information,” she added. “Attackers can also gain access and then manipulate a system’s operational technology, disrupting the treatment or distribution of water or altering the levels of chemicals to potentially dangerous amounts.”

Why it matters: There are approximately 170,000 water and wastewater utilities across the U.S., whose systems are increasingly utilizing digital tools. 

• Malicious attacks could cause water system outages, driving emergency calls, while homeowner concerns about water quality may boost whole-home filtration and treatment demand. 

State of play: “According to WaterISAC [a water security-focused nonprofit], from April 2024 through March 2025, roughly 14 percent of water utilities responding to its quarterly incident survey reported experiencing at least one cybersecurity incident,” said Scott Dewhirst, who was testifying on behalf of the Association of Metropolitan Water Agencies.

• “This is an increase from about 11.5 percent of responding water systems during the same period the year before,” he added.

Go deeper: Sen. Sheldon Whitehouse noted, “Since 2023, Russian, Iranian, and Chinese hackers have successfully attacked small municipal water systems in Texas, Pennsylvania, and Massachusetts, and have tested the security capabilities of countless other systems.”

• Meanwhile, “Over the past six years, Rhode Island municipal facilities, including a large wastewater utility, have experienced at least six cyberattacks, collectively resulting in hundreds of thousands of dollars in losses,” he added. “These are just the incidents that have been reported.”

What we’re watching: Risks of cyberattacks — and espionage — are increasing with AI. 

• During the hearing, speakers described the need for more funding, training, and technical assistance for water managers across the U.S. 
• Capito called for improved data collection on cyber incidents, and Dewhirst highlighted a bill pending in Congress that would establish a governing body to develop cybersecurity requirements for drinking and wastewater systems.