The largest regulated water utility in the United States took its own billing systems offline for about a week while it had no indication its water and wastewater facilities were impacted. Nobody has ever said how it happened.
There is a version of this incident that reads as a success: somebody detected unauthorized activity on a corporate network, could not determine how far it went, so the company shut down its own billing for a week as a precaution. Customers were inconvenienced but the water was fine. On the consequence ladder it is an IT compromise with no physical operation halted on the record.
That proves people were paying attention; it does not prove the architecture held. The separation between the business network and the plant’s was enforced by a decision made under time pressure, on incomplete information, by humans who happened to be good at their jobs that week. Reflexes are fast, but they fail on a holiday weekend, during a systems migration, or the third time an alert turned out to be nothing. A margin that depends on somebody noticing is a margin you cannot put a number on. That is BlastWave’s analysis.
What is not known: The mechanism has never been stated by the company, the EPA, CISA, the FBI or WaterISAC. “Ransomware” returns zero hits in EDGAR full-text search against CIK 0001410636 across every periodic and current report, against fifteen for the control term “cybersecurity incident.” The earliest dated attribution of ransomware to this incident was a doubly hedged speculation by an outside CISO on 10 October 2024. Forty-eight days later it was in print with no hedge at all. Hackopedia printed it too. This entry is a correction of our own.
Recommendation
Take the path away The disconnect worked because a person made it. Leave no path from business IT to plant OT and nothing a corporate host can enumerate, so no one has to notice in time.
Bind vendor access to identity Billing, metering and SCADA vendors should each reach exactly one system, bound to a verified identity rather than a network position.
Let billing read one way What the business side needs from operations arrives over a path that cannot write back, so taking billing offline is never a question about the plant.
Sources: Form 8-K, 7 Oct 2024 (Item 8.01); Form 8-K, 10 Oct 2024 (Items 7.01, 9.01); FY2024 Form 10-K, Item 1C; House Homeland Security, Cyber Threat Snapshot, 12 Nov 2024; EDGAR full-text search, CIK 0001410636. Full list with links.
Soft Spots: That a person’s decision, not the architecture, held the separation is BlastWave’s analysis, not a disclosed fact. The 48 days runs from the earliest dated attribution found: a sequence of publications, not a causal chain.
The full record
Every claim numbered to its source. Last updated .
The largest regulated water utility in the United States took its own billing systems offline for about a week while it had no indication its water and wastewater facilities were impacted. What is verified, what is only reported, and what is still unknown.
Summary
On 3 October 2024, American Water, the largest regulated water and wastewater utility in the United States, found unauthorized activity in its computer networks and took its MyWater portal and billing offline for about a week. It said the incident did not affect water quality. It never confirmed its plants were untouched, and how the intruder got in remains undisclosed.
Timeline of the American Water cyber incident
Every date is tied to a source. Press reporting appears only as evidence of what was said.
American Water learns of unauthorized activity within its computer networks and systems and activates its incident response protocols. The filings date the discovery, not the disconnect.1
The company files a Form 8-K under Item 8.01, Other Events. It says it took steps "to protect its systems and data, including disconnecting or deactivating certain of its systems," and that it "currently believes" none of its water or wastewater facilities or operations were negatively impacted. The same day The Record reports the company notice that all billing has been paused, and CyberScoop reports that "No ransomware gang has claimed responsibility."1,6,7
A second Form 8-K (Items 7.01 and 9.01) furnishes a press release: the MyWater portal is operational, billing is resuming, there will be no late charges, the company "continues to have no indication" its facilities were impacted, and "The incident did not affect water quality." The same day IT Pro quotes an outside CISO speculating, with two hedges, that it was potentially a ransomware event.3,11,12
Forescout writes that "it is too early to draw conclusions."13
WaterISAC says it has not received any additional details beyond American Water's public statements. eSecurityPlanet pairs ransomware and phishing as the tactics such incidents "often involve," at the level of genre.4,14
ZPE Systems publishes "How the Attack Likely Happened," four scenarios presented as scenarios.15
The House Homeland Security Committee's Cyber Threat Snapshot describes a breach "by an unidentified cyber threat actor" and a shutdown of the portal and billing "in an attempt to protect customer data."5
A Spin.AI blog states, with no hedge and no citation, that American Water "was targeted by a ransomware attack." Forty-eight days after the earliest dated attribution found.16
The FY2024 Form 10-K, Item 1C, states that the company "has not experienced a cybersecurity incident that has resulted in a material impact" to its financial condition, results, cash flows or business strategy.10
SEC full-text search across American Water Works Company, Inc. filings returns zero hits for "ransomware" and fifteen for "cybersecurity incident."8
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Form 8-K on 7 October 2024 under Item 8.01 (Other Events), not Item 1.05; update on 10 October under Items 7.01 and 9.011,11
Verified
Were the plants affected?
Hedged twice, never confirmed: "currently believes" none negatively impacted (7 Oct); "continues to have no indication" (10 Oct)1,3
Not confirmed (company hedged)
Was water quality affected?
"The incident did not affect water quality." The only unhedged claim on the record3
Verified
What was taken offline?
The MyWater customer portal and billing, for roughly a week; billing paused, no late charges3,7,9
Verified
Why were systems disconnected?
"to protect its systems and data"; the company never said it was to protect the plants1,9
Verified
Was customer data affected?
Customer Personal Information, "as that term is defined by the state data breach notification laws in the states in which we have regulated operations," was not impacted, per the company9
Verified (as defined by state law)
Was it ransomware?
Never stated by the company; zero filings use the word. The earliest dated attribution found is hedged outside speculation; the unhedged version found cites nothing8,12,16
Undisclosed
Who was behind it?
No group has claimed it; a House Homeland Security Committee document describes "an unidentified cyber threat actor"5,6
Undisclosed
How did the intruder get in?
Not stated by the company, the EPA, CISA, the FBI or WaterISAC1,4
Undisclosed
Financial impact
No figure published. FY2024 10-K: no incident "resulted in a material impact"10
Undisclosed
Were American Water's treatment plants affected?
The company never said its plants were unaffected; it said, in two different hedges on two different days, that it had no reason to believe they were. Its first filing, four days after discovery, read:
"currently believes that none of its water or wastewater facilities or operations have been negatively impacted"
Three days later, in the press release furnished with its second 8-K, the company said it "continues to have no indication that its water and wastewater facilities were impacted."3,11 "Currently believes" describes the company's state of mind. "No indication" describes an absence of evidence. Neither is a confirmation, and neither should be repeated as one.
"The incident did not affect water quality."
That sentence is the only unhedged claim in the record, and it is a claim about water quality, not about whether anyone reached a plant. On the consequence ladder this is an IT compromise with no physical operation halted on the record: the company disconnected its own business systems, it had no indication its facilities were impacted, and nothing on the record shows the intrusion reached operational technology.
Was the American Water incident ransomware?
American Water has never characterized it that way in any filing, and no group has ever claimed it. As of September 2026, SEC full-text search across every periodic and current report filed by American Water Works Company, Inc. (CIK 0001410636) returns zero hits for "ransomware," against fifteen for the control term "cybersecurity incident."8 The 8-K of 7 October 2024 and the 8-K of 10 October 2024 do not use the word.1,11
The early reporting was accurate on this point. CyberScoop wrote on 7 October 2024 that "No ransomware gang has claimed responsibility"; the word appears in that article's web address, not in any claim.6 The Record reported the same day that the incident "has not been claimed by any ransomware gang or hacker group as of Monday afternoon."7 The House Homeland Security Committee described "an unidentified cyber threat actor."5
Where did the ransomware claim come from?
From a sequence of dated publications that begins with a doubly hedged speculation on 10 October 2024 and reaches an unhedged, unsourced statement of fact 48 days later. The earliest dated attribution we found is an outside CISO, quoted by IT Pro's Solomon Klappholz. It is the most careful sentence in the chain and is quoted here complete:
"If I had to speculate, I would say that American Water was potentially the victim of a ransomware event."
14 October 2024: Forescout, "it is too early to draw conclusions."13
15 October 2024: WaterISAC has received no details beyond the company's public statements.4
15 October 2024: eSecurityPlanet notes the company "has not disclosed the exact method of attack" and pairs ransomware with phishing as tactics such incidents "often involve," at the level of genre.14
18 October 2024: ZPE Systems, "How the Attack Likely Happened," four scenarios, honest about being scenarios.15
27 November 2024: Spin.AI, with no hedge, no qualifier and no citation of any kind.16
"On October 3, 2024, American Water company was targeted by a ransomware attack"
This is a sequence, not a chain of cause and effect. Spin.AI cites nothing, so there is no documented link from the 10 October speculation to the 27 November statement. What the dates show is how fast a hedge evaporates when nobody holds it in place. The same Spin.AI post offers weak credentials as a possible means with its own hedge, "This may very well be the means attackers used in this case," downstream of a classification that was never established.16
How did the intruder get into American Water's network?
Nobody has said. As of the September 2026 review, the mechanism has not been stated by the company, the EPA, CISA, the FBI or WaterISAC.1,3,4 WaterISAC wrote on 15 October 2024 that it "has not received any additional details outside of the public statements on American Water's website."4
Speculation filled the gap. ZPE Systems' 18 October 2024 post, "How the Attack Likely Happened," offered four scenarios: phishing or social engineering, ransomware, IT and OT integration, and internet-facing systems. It did not say unpatched systems or supply-chain compromise.15 Neither of those has ever been asserted as this incident's vector by any other source; our own Volume 1 entry originated both.
Why did American Water shut down billing and its customer portal?
To protect its systems and data, in the company's words. It never said the shutdown was to protect the plants. The 7 October 2024 8-K says the company took steps "to protect its systems and data, including disconnecting or deactivating certain of its systems."1 Its security FAQ says it disconnected systems "to protect our customers' data and to prevent any further harm to our environment."9 The House Homeland Security snapshot says the portal and billing were shut down "in an attempt to protect customer data."5
Billing was paused, and the company said: "There will be no late charges during the short period when our customer and billing platform was unavailable."3,7 By 10 October 2024 the MyWater portal was back online and standard billing was resuming, roughly a week after discovery.3,9
On customer data, the company's statement carries a legal qualifier that must travel with it. It does not say no customer data was affected. It says:
"customer Personal Information (PI), as that term is defined by the state data breach notification laws in the states in which we have regulated operations (i.e., NJ, PA, MO, IL, IN, IA, WV, VA, CA, HI, KY, TN, GA, MD), was not impacted."
What is still not known about American Water
How the intruder got in. The company, the EPA, CISA, the FBI and WaterISAC have not stated a vector.1,4
Who was behind it. No group has claimed the incident.6,7
What malware, if any, was involved. No filing names any.8
Whether anything reached the water and wastewater facilities. The company said it had "no indication"; it never confirmed they were untouched.3
When the systems were disconnected. The filings date the discovery, 3 October 2024, but not the disconnect.1
How far the unauthorized activity extended inside the company's networks.
The incident's cost. The company has published no figure, only a materiality statement.10
Claims about American Water the record does not support
Widely repeated claim
What the record says
"American Water was hit by a ransomware attack."
No American Water filing uses the word, and no group ever claimed the incident. The earliest dated attribution found is a doubly hedged speculation; the unhedged version cites nothing.8,12,16
"The attackers got in through phishing, unpatched systems or a supply-chain compromise."
The vector has never been stated by the company, the EPA, CISA, the FBI or WaterISAC. Unpatched systems and supply-chain compromise have never been asserted as the vector by any other source; our own Volume 1 entry originated them.4,15
"Weak credentials were the root cause."
Traces to one hedged sentence in a vendor blog that cites nothing: "This may very well be the means attackers used in this case."16
"American Water confirmed its plants and operational technology were unaffected."
It hedged twice: "currently believes" (7 October) and "continues to have no indication" (10 October). The only unhedged claim is about water quality.1,3
"American Water shut down billing to protect its treatment plants."
The stated purposes were to protect its systems and data, and its customers' data. No company or federal statement gives the plants as the motive.1,5,9
"No customer data was affected."
The company's statement is qualified: customer Personal Information "as that term is defined by the state data breach notification laws in the states in which we have regulated operations" was not impacted.9
Including our own. The Volume 1 Hackopedia entry listed the attacker as "Unknown Ransomware," the vector as phishing, unpatched systems or supply-chain compromise, and the root cause as "Weak Credential," and said the company had confirmed its operational technology and water quality were unaffected. None of it survives as written: the company stated only the water-quality half. Two of the three vectors had never been asserted as this incident's vector by anyone; we originated those. The entry carried a "Contested" flag while the fields beneath it read as determinations. Those four fields now read Undisclosed.17 We correct our own record first; it is what earns the right to correct anyone else's.
BlastWave analysis: the save was a decision, not an architecture
Analysis, not a disclosed fact
There is a version of this incident that reads as a success: somebody detected unauthorized activity on a corporate network, could not determine how far it went, and the company shut down its own billing for a week as a precaution. Customers were inconvenienced but the water was fine. American Water drafted carefully and acted well, and the people who made that call deserve full marks.
That proves people were paying attention; it does not prove the architecture held. The separation between the business network and the plant's was enforced by a decision made under time pressure, on incomplete information, by people who happened to be good at their jobs that week. Reflexes are fast, but they fail on a holiday weekend, during a systems migration, or the third time an alert turned out to be nothing. A margin that depends on somebody noticing is a margin you cannot put a number on. That is BlastWave's analysis, not a disclosed fact.
Podcast: “The Fire Watch” (9:57). Joe Baxter and Cam Cullen on why a save that depended on somebody noticing deserves full marks for the people and a permit with an end time for the arrangement.
Video: American Water Short (60 to 90 seconds).
Frequently asked questions
What happened at American Water in October 2024?
On 3 October 2024, American Water, the largest regulated water and wastewater utility in the United States, learned of unauthorized activity in its computer networks and systems. It disconnected or deactivated some systems, taking its MyWater customer portal and billing offline for about a week. It said on 10 October 2024 that the incident did not affect water quality. How the intruder got in has never been disclosed.
Was the American Water cyber incident ransomware?
American Water has never said so. As of September 2026, none of its SEC filings uses the word, and no group ever claimed the incident. The earliest dated attribution found is an outside CISO's hedged speculation in IT Pro on 10 October 2024. A Spin.AI blog stated it as fact on 27 November 2024 without citing any source. The classification is unsupported by the record.
Were American Water's treatment plants or drinking water affected?
The company said on 10 October 2024 that the incident did not affect water quality. About the facilities it hedged: on 7 October it said it currently believed none had been negatively impacted, and on 10 October that it continued to have no indication they were. It never confirmed the plants were untouched, and nothing on the record shows the intrusion reached them.
How did hackers get into American Water?
Nobody has said. As of September 2026, the company, the EPA, CISA, the FBI and WaterISAC had not stated how the intruder got in. WaterISAC said on 15 October 2024 it had no details beyond the company's public statements. Published claims of phishing, unpatched systems, supply-chain compromise or weak credentials are speculation, and unpatched systems and supply-chain compromise were never asserted as the vector by any source other than Hackopedia's own Volume 1 entry, which originated them.
Was American Water customer data stolen?
American Water's security FAQ says customer Personal Information, as that term is defined by the state data breach notification laws in the states in which it has regulated operations, was not impacted. That qualifier matters: the company did not say that no customer data of any kind was affected, and the statement should not be repeated without it.
Why did American Water shut down its billing system?
The company's 7 October 2024 Form 8-K says it acted to protect its systems and data, including disconnecting or deactivating certain systems. Its security FAQ says it disconnected systems to protect customers' data and prevent further harm to its environment. Billing was paused and late charges were waived. The company never said the shutdown was to protect its treatment plants.
Did the American Water incident have a material financial impact?
The company has published no cost figure. In its FY2024 Form 10-K, Item 1C, American Water said it has not experienced a cybersecurity incident that has resulted in a material impact to its financial condition, results of operations, cash flows or business strategy. A materiality statement is not a cost, so the financial impact remains undisclosed.
Primary sources are American Water's own SEC filings and dated statements, a congressional committee document and a sector ISAC update. Press and vendor blogs are cited only as evidence of what was said.
Company filingAmerican Water Works Company, Inc., Form 8-K, Item 8.01, "Discovery of and Response to Cybersecurity Incident," 7 October 2024. sec.gov
CompanyAmerican Water, "Overview of American Water," company website. amwater.com
CompanyAmerican Water, "American Water Reactivating Systems After Cyber Event," press release, 10 October 2024, furnished as Exhibit 99.1 to the Form 8-K of the same date. sec.gov · newsroom.amwater.com
ResearcherWaterISAC, incident awareness update on a major water utility cyber attack, 15 October 2024. waterisac.org
GovernmentHouse Committee on Homeland Security, Cyber Threat Snapshot, 12 November 2024. homeland.house.gov · PDF
PressCyberScoop, report on the American Water Works cyber incident, 7 October 2024. Cited as evidence of what was said. cyberscoop.com
PressThe Record, report on the American Water Works incident and billing pause, 7 October 2024. Cited as evidence of what was said. therecord.media
FederalUS Securities and Exchange Commission, EDGAR full-text search, filings of American Water Works Company, Inc. (CIK 0001410636), terms "ransomware" (0 hits) and "cybersecurity incident" (15 hits), checked September 2026.
CompanyAmerican Water, "IT Security FAQs: Reactivation of Systems," company website. amwater.com
Company filingAmerican Water Works Company, Inc., Annual Report on Form 10-K for the fiscal year ended 31 December 2024, Item 1C, Cybersecurity. sec.gov
Company filingAmerican Water Works Company, Inc., Form 8-K, Items 7.01 and 9.01, 10 October 2024. sec.gov
PressSolomon Klappholz, "Cyber expert suggests American Water cyber incident was a ransomware attack," IT Pro, 10 October 2024. Cited as evidence of what was said. itpro.com
ResearcherForescout, blog post on the American Water security incident, 14 October 2024. Cited as evidence of what was said. forescout.com
PressSunny Yadav, "American Water Shuts Down Services After Cybersecurity Breach," eSecurityPlanet, 15 October 2024. Cited as evidence of what was said. esecurityplanet.com
ResearcherZPE Systems, blog post on the American Water cyberattack, 18 October 2024, section "How the Attack Likely Happened." Cited as evidence of what was said. zpesystems.com
ResearcherSpin.AI, blog post on American Water, 27 November 2024 (page now shows an update dated 17 January 2025). Cited as evidence of what was said; it cites no source. spin.ai
CompanyBlastWave, Hackopedia Volume 1, "American Water" entry (superseded by this page).
Cite this page
BlastWave. “American Water Cyber Incident (2024): What Is Verified.” Hackopedia, Volume 2, FILE 021. Last verified 28 September 2026. https://hackopedia.blastwave.com/water/american-water-2024/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 021 in Hackopedia Volume 2, in the Water edition.
28 Sep 2026
Hand-check at source: the FY2024 10-K materiality sentence, the SEC full-text search counts and the eSecurityPlanet article re-read. Summary corrected so it no longer attributes to the company a motive it never stated (protecting the plants); it now uses the company's own 10 October hedge. Financial impact now leads with Undisclosed, and the consequence level is stated.
26 Sep 2026
Full validation: both 8-Ks, the 10 October press release, the company's security FAQ, the House Homeland Security snapshot and every dated publication in the 48-day sequence re-read.
17 Sep 2026
Entry rebuilt from primary sources after a full record audit on 11 September 2026, as a correction of the Volume 1 entry: attacker, vector, root cause and malware now read Undisclosed.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
