2024 American Water Works — Oct. cybersecurity incident; customer systems taken offline proactively
Data compromised
American Water’s initial regulated-state customer-PI assessment was “not impacted”; non-public or out-of-footprint nuances left to supplemental notices
Technical writeup
On 3 October 2024, American Water disclosed unauthorized activity on portions of its IT network, treated as a cybersecurity incident, prompting containment steps that included temporarily disconnecting systems such as the MyWater customer portal and billing. The company’s subsequent FAQ and press materials stated no negative impact to water/wastewater operations or drinking-water safety, and—across its regulated-state footprint—that customer personal information as defined in applicable breach-notification statutes was not impacted (with follow-on language about out-of-footprint residents handled under other state rules). Services were reactivated on a staged basis around 10 October 2024 in public messaging.
Root cause
Cybersecurity incident on corporate IT environment; technical intrusion details not fully published in early FAQ window