Loading story…
U.S. policymakers are advancing new cybersecurity measures for the water and wastewater sector, with separate federal and state initiatives aimed at improving defenses for under-resourced utilities. A bipartisan federal proposal, the FLOWS Act, would provide the Environmental Protection Agency with $50 million annually to help small and rural water systems modernize cybersecurity capabilities, digital monitoring, and operational technology support without requiring local cost sharing that often blocks access to federal aid.
In New York, state officials finalized what they describe as first-of-its-kind cyber mandates for public water systems and paired them with a $2.5 million grant program to support risk assessments and security upgrades. The rules establish enforceable requirements for drinking water and wastewater operators to create formal cybersecurity programs, identify risks, and implement technical safeguards for operational systems, reflecting broader concern that the water sector remains a comparatively weak point in U.S. critical infrastructure security.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Governor Ron DeSantis signed Florida's state budget after vetoing several approved expenditures, including a nearly $1.7 million project to add cybersecurity protections to a water utility network in Palm Bay. The cut was reported alongside broader concerns about cyber weaknesses in U.S. water utilities.
Microsoft reported that U.S. water and wastewater utilities need hands-on cybersecurity assistance and workforce incentives, arguing that training alone is insufficient to improve resilience. The company recommended integrating cybersecurity into operator requirements, using trusted sector associations, and mandating training for operator certifications.
Senators John Boozman and Mark Kelly unveiled the Futureproofing Local Operations for Water Systems (FLOWS) Act, a bipartisan bill to provide the EPA with $50 million annually to help small and rural utilities modernize cybersecurity systems and digital monitoring tools. The proposal would remove matching-fund requirements that often block under-resourced communities from receiving federal assistance.
New York finalized what it described as a first-of-its-kind cybersecurity regulatory framework for public water and wastewater utilities, requiring formal cybersecurity programs, risk identification, and technical safeguards for operational systems. The state paired the rules with a $2.5 million grant program offering up to $50,000 for assessments and up to $100,000 for security upgrades.
Between 2023 and 2025, Microsoft, the Cyber Readiness Institute, and the Foundation for Defense of Democracies conducted a pilot cybersecurity assistance program for U.S. water and wastewater utilities. Of 119 interested utilities, 72 enrolled and 43 completed the initiative, with coached participants showing much higher completion rates than self-paced ones.
In January 2024, a cyber incident attributed to pro-Russian hackers caused drinking water to overflow from a Texas utility. The attack was later cited by officials and media as an example of the water sector's exposure to cyber threats.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
statescoop.com
Open sourcescworld.com
Open sourcescworld.com
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
New York has expanded its effort to protect drinking water and wastewater systems by pairing statewide cybersecurity requirements with more than **$9 million** in SECURE grant funding for **153** utilities. State officials said the program supports cybersecurity assessments, security upgrades, operator training, incident reporting, and risk-based protections, while requiring larger drinking water systems to designate cybersecurity leads. The initiative builds on regulations issued by the Departments of Environmental Conservation and Health and is administered through the Environmental Facilities Corporation with technical assistance for local communities. The funding push comes as U.S. water infrastructure faces heightened operational technology threats. A recent multistate campaign targeted more than 30 community water systems in Minnesota, with additional incidents reported in at least seven states including Michigan, South Dakota, and Georgia. Federal investigators have not formally attributed the activity, but Iran is considered a leading suspect because the tactics resemble earlier operations against industrial control systems and water utilities. In response, **CISA** urged operators to remove internet-exposed PLCs and strengthen remote access and password security.
Aug 5, 2026
New York finalized **cybersecurity regulations** for water and wastewater organizations, requiring covered utilities to implement baseline protections and prepare for disruptive cyber incidents. The rules include **incident reporting**, **incident response and recovery planning**, mandatory cybersecurity training for certified operators, and designation of a cyber lead for larger utilities. Coverage applies to community water systems serving more than 3,300 people, with additional obligations for larger organizations, as state officials cited escalating threats to the sector and the need to act despite stalled federal mandates. The requirements also call for written **vulnerability management** procedures, stronger access controls such as **multi-factor authentication**, bans on default credentials, and segmentation of **operational technology** from IT and external networks; larger facilities must also conduct network monitoring and logging. To support compliance, the state launched a **$2.5 million grant program** and technical assistance effort, with funding available for cybersecurity evaluations and defensive upgrades. The measures were framed as a response to persistent targeting of water infrastructure, including campaigns linked to **China** and **Iran**, and as an effort to improve resilience and continuity of operations during cyberattacks.
Jun 29, 2026
Senators Adam Schiff and Amy Klobuchar introduced a comprehensive cybersecurity bill aimed at strengthening protections for U.S. water infrastructure after recent cyberattacks on water systems. The legislative push follows longstanding federal concern over the sector’s weak cyber posture, including a **GAO** finding that the **EPA urgently needs a strategy** to address cybersecurity risks across water and wastewater systems, underscoring gaps in oversight, coordination, and resilience for a critical public service. The move comes as sector-specific defenders continue to warn utilities about exploitable flaws in widely used technology. **WaterISAC** highlighted several high-priority vulnerabilities for water and wastewater operators, including `CVE-2026-8037` in **Progress LoadMaster** (unauthenticated OS command injection leading to remote code execution), `CVE-2026-68820` in **Microsoft Windows** (privilege escalation), `CVE-2026-72898` in **Metabase** (SQL injection that can enable unauthenticated administrator access), and `CVE-2026-19516` in **Grafana MCP Server** (server-side request forgery), noting that multiple issues are listed in **CISA’s Known Exploited Vulnerabilities** catalog.
Aug 14, 2026