U.S. Water Systems Face Dual Threats from Cyberattacks and Aging Infrastructure

The United States' drinking water systems are under increased scrutiny following suspected cyberattacks linked to Iran, which have exposed longstanding vulnerabilities in a fragmented network of utilities struggling with aging infrastructure and the impacts of climate change. Kevin Morley, federal relations manager for the American Water Works Association (AWWA), highlights that utilities must now address acute cybersecurity threats alongside chronic challenges such as deteriorating infrastructure and extreme weather events.

There are over 144,000 public water systems in the U.S., with approximately 50,000 community water systems providing year-round drinking water to residents. The sheer number of independently managed utilities complicates efforts to modernize infrastructure and maintain consistent cybersecurity standards across the country. Andrew Whelton, a professor at Purdue University, notes that these challenges are not unique to any single administration but rather reflect long-standing issues that have accumulated over successive presidential terms.

Many investment decisions in water systems are made locally due to municipal regulations governing water rates, which can make it difficult for utilities to secure the funding needed to replace aging infrastructure. Professor Whelton emphasizes that while much of America's drinking water infrastructure is decades old, many utilities are using replacement projects as an opportunity to redesign their systems to better withstand cyberattacks and natural disasters.

The AWWA has been advocating for nationwide minimum cybersecurity requirements for water utilities and recently sent a letter to Congress urging federal support. The organization highlights the need for cultural shifts in understanding the reality of these threats and the potential risks they pose. In 2025, the EPA identified vulnerabilities at 277 water systems and worked with utilities to address them, underscoring the ongoing efforts to strengthen defenses.

Extreme weather events are also forcing utilities to rethink their resilience strategies. Recent wildfires in Washington state have highlighted how even low-risk areas must now prepare for unexpected disasters. Utilities are increasingly balancing investments in cybersecurity with the need to replace aging pipes, pumps, and treatment equipment, all while facing additional stress from extreme heat, floods, droughts, and wildfires.

Smaller community water systems often lack the staff and resources necessary to tackle cyber threats and climate resilience independently. Many depend on state agencies and industry associations for expertise, which can further complicate efforts to modernize and secure these critical infrastructures. As utilities grapple with multiple simultaneous challenges, there is a growing recognition that cybersecurity, climate change adaptation, and infrastructure renewal must be addressed as interconnected issues rather than separate problems.

The dual threats of cyberattacks and aging infrastructure pose significant risks to public health and essential services in the United States, necessitating coordinated efforts at both federal and local levels to enhance resilience and security.