In response to an alarming trend of cyberattacks targeting water utilities nationwide, New York state is accelerating the deployment of over $9 million in cybersecurity grants aimed specifically at its water infrastructure. This proactive measure comes amidst a series of sophisticated hacking incidents that have severely disrupted water systems across the United States.

Governor Kathy Hochul’s office announced on Monday that it has initiated a program to administer statewide cybersecurity grants, a move that is being seen as a crucial step toward safeguarding essential public services against the backdrop of growing cyber threats. Recent attacks have raised concerns about the vulnerability of water systems, prompting the state to take decisive action (see: Hackers Disrupt Controls at Minnesota Water Utilities).

While U.S. officials have not explicitly pointed to any specific nation or hacking group as being responsible for the water systems’ disturbances, the timing of these attacks coincides with escalated military actions between the U.S. and Iran. This pattern has led to increased speculation regarding state-sponsored cyber threats, particularly given the historical context of Iranian-backed hackers targeting critical infrastructure.

Colin Ahern, State Security and Intelligence Director, emphasized the importance of swift action, noting that the decision to allocate these funds was influenced by the increasing sophistication of cyberattacks on water systems. He stated, “We think it’s a good opportunity for people to realize that this issue is real and it’s happening.” His comments underline a growing recognition of the potential risks to public safety stemming from unprotected utility systems.

Three states have now publicly acknowledged that their water systems have faced malicious cyber activities. Minnesota IT Services confirmed that over 30 community water systems fell victim to coordinated attacks on July 26 and 27, culminating in significant disruptions to their automated controls. Similarly, officials from Michigan reported that nine municipal water systems experienced cyber activities consistent with alerts from federal agencies. Additionally, Rapid City, South Dakota, managed to thwart a cybersecurity incident at its wastewater lift stations, which, although serious, never endangered the water supply.

On July 31, the FBI, EPA, and CISA jointly issued an advisory warning of the targeting of internet-exposed industrial controllers used widely by water and wastewater utilities. Reports indicated that some facilities lost vital monitoring and control functionalities, leading to concerns about operational disruptions. While the primary focus has been on the malicious access to remotely monitored technology, fortunately, no instances of compromised drinking water supplies have emerged from the affected states.

Federal investigators are currently looking into whether Iranian operatives are linked to this series of cyberattacks. This follows earlier warnings that hackers affiliated with Iran had previously been active in probing water systems and other critical infrastructure in the U.S., particularly during times of heightened geopolitical tensions. Notably, the White House has so far refrained from confirming any connections to Iranian actors.

The ambitious grant program is poised to fund over 150 local government initiatives statewide, aimed at boosting the cybersecurity posture of water and wastewater systems. These grants are intended to help these systems comply with mandatory cybersecurity regulations New York implemented earlier this year. These groundbreaking directives require all water utilities to conduct risk assessments, offer operator training, implement cybersecurity controls, and maintain incident reporting mechanisms, especially for larger systems (see: New York Unveils ‘Nation-Leading’ Water Sector Cyber Rules).

The program, managed by the state’s Environmental Facilities Corporation, allocates up to $50,000 for cybersecurity risk assessments and up to $100,000 for comprehensive hardening and implementation projects. The corporation also provides a centralized cybersecurity hub offering training and one-on-one consultations, along with community support teams available to assist smaller water systems at no charge to implement best practices.

Historically, the water sector has been identified as one of the most vulnerable segments of U.S. critical infrastructure. Many small utilities operate with limited budgets, aging operational technology, and little to no dedicated security personnel. Recent incidents have emphasized the urgent need for enhanced cybersecurity measures, particularly given past attacks, such as those attributed to Iranian-linked hackers who successfully defaced internet-exposed controllers at a Pennsylvania water authority and other utilities in late 2023 (see: Iranian Hacking Group Attacks Pennsylvania Water Authority).