%202.svg)
American Water Works Company, Inc.
Not attributed. No actor has ever claimed or been publicly linked to this incident. The company has never characterised the incident as ransomware in any filing or statement.
Water
Customer portal and billing systems disconnected for approximately one week. The company stated it had "no indication" that water and wastewater facilities were impacted, and stated separately that water quality was not affected.
Not disclosed. No vector has ever been stated by the company, any regulator, or any investigating body.
Not disclosed.
Network Cloaking, Passwordless Access, and Segmentation
On 3 October 2024, American Water Works, the largest regulated water and wastewater utility in the United States, learned of unauthorized activity within its computer networks and systems. It notified law enforcement, engaged third-party incident response, and disconnected or deactivated systems including its MyWater customer portal and billing platform. Service was restored on 10 October 2024. Late charges were suspended for the duration.
The company disclosed the incident to the SEC on 7 October 2024 under Item 8.01, Other Events, rather than Item 1.05, Material Cybersecurity Incidents. It stated that it "currently believes that none of its water or wastewater facilities or operations have been negatively impacted," and three days later that it "continues to have no indication" that those facilities were impacted, and that water quality was not affected. Neither formulation is a confirmation, and the distinction is the company's, not ours.
No vector, actor or malware family has ever been publicly established. No group has claimed the incident. The word "ransomware" appears in no American Water SEC filing. Widely circulated accounts describing this as a ransomware attack trace to a single security executive's explicitly labelled speculation on 10 October 2024, which lost its hedge as it was repeated. Earlier versions of this entry repeated that characterisation and added two attack vectors and a root cause that no source has ever asserted for this incident. See the editor's note.
What the response does suggest is architectural. The company disconnected its own revenue systems to protect operational environments it had no indication the intruder had reached. That is consistent with a boundary between the business estate and the plant that has to be enforced by hand under time pressure rather than one that holds on its own. This is an inference from the shape of the response, not a disclosed finding.
The disclosed facts do not identify a vulnerability, and we should not pretend otherwise. What they identify is a dependency. Protecting the operational environment required people to notice unauthorized activity, assess it quickly, and choose to break the company's own billing for a week on incomplete information. That decision was made well. It was still a decision, and decisions have a response time, a person attached to them, and a worse version on a holiday weekend.
Network cloaking removes the operational environment from the corporate network's view, so an intruder with control of the business estate has nothing to scan and nothing to orient toward. Identity-defined microsegmentation authorises every session against a verified identity on a verified device, so network position stops conferring reach. Together they aim at making containment a property of the architecture rather than an action somebody has to take, which is the difference between fourteen million people being fine by design and fourteen million people being fine because the right person was at their desk on a Thursday.
Editor's note, 11 September 2026. An accuracy review of this entry found that several fields asserted facts the public record does not contain.
Earlier versions listed the attacker as "Unknown Ransomware," the attack vector as "phishing, unpatched systems, or supply-chain compromise leading to ransomware installation," and the root cause as "Weak Credential." None of that was disclosed by American Water, by any regulator, or by any investigating body, and no group has ever claimed the incident. The word "ransomware" appears in no American Water SEC filing. Two of the three listed vectors have never been asserted as the vector for this incident by any source, and the root cause traces to a single vendor blog's speculation. We printed all of it as determinations, and that is our error, not an inherited one.
This entry also previously stated that the company "confirmed" its operational technology and water quality were unaffected. American Water said it "currently believed" and later had "no indication" that its water and wastewater facilities were impacted, and stated separately that water quality was not affected. We have restored the company's own language.
The industry classification has been corrected from Energy to Water and Wastewater. The prevention analysis has been rewritten to remove an absolute product claim and a premise about physical separation that is not disclosed anywhere.
The argument that the IT to OT boundary here was enforced procedurally rather than architecturally is BlastWave's inference from the shape of the response. It is now labelled as such wherever it appears.
This entry now carries the status Vector undisclosed. The incident is real and documented. How it happened has never been stated by anyone.
Reading about past failures is only useful if it changes future outcomes. If attackers can see your OT network, they can target it. If they can target it, compliance, safety, and uptime are already at risk.
BlastWave eliminates reconnaissance, initial access, and lateral movement — without agents, without downtime, and without changing IPs, protocols, or PLCs.