American Water pauses billing after cyberattack on internal systems

American Water, the largest regulated water and wastewater utility in the United States, said it learned of unauthorized activity on its computer networks and systems on October 3, 2024. The company disclosed the incident in a filing with the U.S. Securities and Exchange Commission on October 7 and activated its incident response plan.

American Water disconnected or deactivated certain systems as a containment measure. The MyWater customer portal was taken offline, the customer call center stopped operating and scheduled appointments were rescheduled. The utility paused billing while the portal was unavailable and said customers would not face late charges or service shutoffs during the outage.

The company serves roughly 14 million people across 14 states and 18 military installations. It said it currently believed that none of its water or wastewater facilities or operations had been negatively impacted, and that water quality was unaffected. Law enforcement was notified and third-party cybersecurity specialists were brought in to investigate and assist with containment.

No ransomware group or other threat actor had claimed responsibility at the time of reporting, and American Water did not say whether a ransom demand had been made or whether customer data had been accessed. The company subsequently began reconnecting the systems it had taken offline, and the MyWater portal and normal billing were restored.