At American Water, containment was the part customers saw

The week

American Water Works, the largest regulated water and wastewater utility in the United States, disclosed on October 7, 2024, in a filing with the Securities and Exchange Commission, that it had detected unauthorized activity in its computer networks on October 3. Public companies must tell investors about significant cybersecurity incidents, and this filing, known as a Form 8-K, is the standard vehicle for announcing material events between regular reports. “Unauthorized activity” is the careful phrase organizations use early on, when they know someone got in where they should not have been but are still working out who, how and what was touched.

The words “cyberattack on a water utility” tend to suggest the worst: someone tampering with treatment chemicals, or taps running dry. What American Water’s customers actually experienced was much more mundane, and much more common: they could not see or pay their bills.

In response, the company disconnected or deactivated certain systems. That is a standard containment step, cutting connections so an intruder cannot spread further. It also had a visible cost. The move took its MyWater customer portal and billing platform offline. Customers who logged in to check an account or make a payment found nothing there.

The company said it did not believe its water or wastewater facilities had been affected, and that customers would not be charged late fees while billing was paused. It notified law enforcement and engaged outside specialists, typically incident response firms that investigate how an attacker got in and help make systems safe to restore.

On October 10, a week after the activity was detected, American Water said the portal was operating again and billing was resuming.

The incident did not come out of nowhere. It followed a period of federal concern about water sector cybersecurity, including an enforcement alert from the Environmental Protection Agency in May 2024 that urged utilities to address basic vulnerabilities. Water systems, many of them small and thinly staffed, had been on regulators’ minds for some time. This time, the water was safe. What the public saw instead was the response.

After a cyberattack on critical infrastructure, the first question is whether the physical service is safe. American Water said its water was. For its customers, the incident was something else: a portal that would not load and bills that stopped arriving.

The pattern repeats across municipal utilities, counties and agencies. When an organization takes systems offline to contain an attack, the public experiences the containment far more than the attack itself. The intruder is invisible. The closed portal, the paused payments and the busy phone lines are not.

So the customer-facing response is part of incident management, and deserves the same planning discipline as forensics or recovery. It consists of four decisions, taken roughly in sequence: what to switch off, what to tell people, how to make them whole, and how to bring them back. Each has a different owner, and together they cover everything the public sees from the first hour to the last notification letter.

Containment first: what happens in the first days of an incident

The four decisions sit on top of what an organization is actually doing in the first days after it detects an intruder.

Most modern organizations run two very different kinds of technology. One is operational technology: the equipment that does the physical work, such as pumps, valves, treatment controls and sensors at a water plant. The other is information technology, or IT: email, billing, customer accounts, payroll and the websites the public uses. In a well-designed utility, the two are kept separate, so that a problem on the office network cannot reach the controls that keep water clean. American Water’s statement that it did not believe its water facilities were affected was, in effect, a statement that the problem stayed on the IT side.

Once an intrusion is detected, incident response typically runs through a familiar sequence. First comes containment: stopping the attacker from moving further or doing more damage, often by disconnecting systems from the network. Then investigation, sometimes called forensics: working out how the attacker got in, what they reached and whether anything was taken. Then eradication and recovery: removing the attacker’s foothold, fixing the weakness, and bringing systems back carefully so the problem does not recur.

A common threat in such incidents is ransomware, a type of malicious software that scrambles an organization’s files so they cannot be used and then demands payment to unscramble them. Attackers increasingly also steal data first and threaten to publish it. Whatever the specific threat, the logic of containment is the same. If you do not yet know how far an intruder has spread, the safe move is to cut connections, even if that means switching off services the public relies on.

When a building’s fire alarm goes off and nobody yet knows where the fire is, everyone is evacuated, including the shop on the ground floor that was doing perfectly good business. Its customers see a locked door and a sign rather than the fire, and whether that sign is clear, honest and reassuring is entirely within the building manager’s control.

What to switch off

Disconnecting customer-facing systems is often the right containment step, especially when portals share infrastructure, identity services or credentials with internal networks. Identity services are the systems that check who you are when you log in; credentials are the usernames, passwords and digital keys that grant access. If a customer portal uses the same identity system as internal staff accounts, an attacker inside one may be able to reach the other.

The decision has public consequences. Payments stop, applications stall and people cannot see their accounts or service status. For a utility, that can also mean a short-term cash flow gap. For a county, it might mean permit applications or benefits renewals freezing in place.

Architecture determines how much choice there is. A payment page hosted separately, with its own credentials and no network path into the core environment, may be able to stay online when everything else goes dark. So can a static outage page that does not depend on the content management system behind the main website. A static page is a simple, fixed web page with no database or login behind it. It is hard to attack and easy to keep up.

Utilities and agencies should know, before an incident, which public services depend on which internal systems and which could run in isolation. The aim is a targeted switch-off, service by service, instead of an all-or-nothing one.

Who decides when to switch back on

The decision also needs an owner and criteria for reversal. In many incidents, systems are disconnected by whoever is on the response call and then stay off longer than necessary because nobody is responsible for deciding when they can return.

A short decision log, recording what was switched off, why and what evidence would justify restoring it, helps both the response and the review afterward. It also gives senior management something concrete to ask about each day: which systems are still off, and what are we waiting for?

What to tell people

Within hours, residents call, post and ask. Silence gets filled by others, often inaccurately. A rumor that the water is unsafe can spread faster than any official statement, and once it has spread it is hard to correct.

Early statements must still be careful: facts are uncertain, law enforcement may be involved, and promises about data or timelines can turn out wrong. An organization that says on day one that no personal data was affected, and then has to retract that on day ten, loses far more trust than one that said “we are still investigating.”

The practical answer is pre-approved templates for what people ask. Five concerns come up first, almost every time:

• Whether their water, benefit or service is affected.
• Whether they need to do anything.
• Whether they will be penalized.
• Whether their personal information is at risk.
• When it will be fixed.

Each answer can be drafted in advance, cleared by counsel and senior management, and completed with specifics in minutes. It should go out on the website, phone lines, social media and local media together. Call center agents and front-desk staff need the same script on the same day, or the public hears several versions. A customer who reads one thing online and is told another on the phone will assume someone is hiding something.

Keeping every channel consistent

For a listed company such as American Water, public statements must also stay consistent with securities disclosures. Investors and customers are reading different documents, but they compare them, and so do journalists. For a municipal utility, statements must align with what the city council and state regulators are told. A single owner for external statements prevents those channels from drifting apart.

How to make them whole

American Water’s commitment that customers would not pay late fees addressed the most immediate worry. It was simple, concrete and easy to understand, which is exactly what reassurance needs to be.

Public services have many equivalents: waiving penalties, extending application windows, pausing collections and shutoffs, and accepting late filings. Each one removes a reason for anxious residents to call, which in turn frees staff to deal with the cases that really need attention.

These measures often need authority held by elected officials, boards or regulators. Seeking it during an incident delays the reassurance that cuts call volumes. Pre-authorizing a standard menu of relief, with conditions for when each applies and how long it lasts, lets an organization announce relief on the first day. For regulated utilities, that may mean agreeing the approach with the public utility commission in advance. The commission is the state body that oversees utilities’ rates and service, and it generally has a say in fees and disconnection policies.

The customers a generic notice misses

Relief should also reach the customers a generic notice misses. Households on medical-need registers, customers enrolled in hardship programs and those on automatic payment plans each face a different problem when billing stops and restarts.

Automatic payments may fail or double when systems return. A family living close to the edge that suddenly sees two water bills drawn from its bank account in one week has a real problem, not an inconvenience. Flagging these groups in advance, with a direct contact plan for each, prevents the cases most likely to end in complaints to regulators or local officials.

How to bring them back

Restoration has its own customer experience. When billing resumes, customers may receive several bills at once. When portals return, users may need to reset passwords, and attackers often send phishing messages that imitate those resets. Phishing is the practice of sending fake emails or texts that look official, in order to trick people into handing over passwords or payment details. A real incident, widely reported, gives fraudsters a perfect cover story.

If personal data was taken, notification letters follow, sometimes months later, prompting a second wave of concern. By then the original incident may have faded from the news, and customers who thought it was over are suddenly told their information may be exposed.

Planning for this phase means deciding how to spread catch-up bills, offering payment plans, telling customers exactly what a legitimate reset message will look like, and preparing call centers for notification letters. It also means a clear account of what happened and what changed. Restoration is a communication event as much as a technical milestone.

Cash, regulators and the people at the counter

Executives and elected officials are often tempted to treat a cyber incident as a technical event that IT handles and they hear about afterward. The American Water episode suggests a different view: the parts of an incident that matter most to customers are business decisions, and they belong at the top.

Revenue and cash flow. When billing pauses, money stops coming in. A large utility can absorb a week; a small municipal utility or a county department may feel it sooner. Knowing in advance how long the organization can run without collecting, and how catch-up billing will work, is a finance question as much as an IT one.

Regulators and elected officials. Utility commissions, councils and state agencies want to know what happened and how customers were treated. Complaints from vulnerable households tend to reach them quickly. An organization that can show a planned, fair response is in a much stronger position in those conversations.

Staff. Call center and front-desk employees absorb the public’s frustration. Giving them clear scripts, accurate information and the authority to offer relief protects them as well as customers.

Trust. For a public service, trust is the asset that matters most. Residents forgive outages more readily than they forgive confusion, mixed messages or penalties for problems they did not cause.

Two counties, the same Tuesday intrusion

Suppose two counties that each run a water and sewer utility and a permitting office detect an intruder on their office network on the same Tuesday.

In the first, the IT manager shuts down everything connected to the main network, which turns out to include the payment portal, the permit application site and the county’s main website. The communications office has no prepared statement and waits for legal advice. By Wednesday, local social media is full of speculation that the water is unsafe. Call center staff improvise answers. Late fees are still being calculated automatically for customers who could not pay. When systems return the following week, customers on automatic payment are charged twice, and a wave of fake “reset your password” emails arrives. The county commission hears about most of this from angry residents.

In the second, the payment page and an outage notice run on separate infrastructure with their own credentials, so they stay up while the core network is isolated. Within two hours, a pre-cleared statement goes out on every channel, answering the five standard concerns and saying plainly that drinking water is not affected. A pre-authorized relief menu waives late fees and pauses shutoffs from day one. Staff call households on the medical-need register directly. A decision log tracks each system that was switched off and what is needed to restore it. Before the portal comes back, customers are told exactly what a legitimate reset email will look like and that the county will never ask for a password by text.

The intrusion was the same. The public experience was entirely different, and almost every difference was decided months earlier.

Where the public response breaks down

A well-prepared organization plans the customer-facing response as part of incident management rather than leaving it to the communications office afterward. It knows which public services can run independently of the core network. It has a decision log and a named owner for switching systems off and back on, pre-approved statements for the concerns residents raise first, and relief measures authorized in advance. And it plans the restoration phase as carefully as the outage.

The breakdowns are familiar:

• All-or-nothing architecture that forces every public service offline at once.
• No owner for restoration, so systems stay off longer than they need to.
• Silence while waiting for certainty, which lets rumors set the story.
• Over-promising early about data or timelines, then having to walk it back.
• Relief that needs a vote mid-crisis, delaying the one message that calms people most.
• Treating restoration as the end, rather than the start of a second wave of bills, resets, scams and letters.

What residents would see if it happened tomorrow

1. If we had to isolate our main network tomorrow, which public-facing services would go dark with it, and could our payment page and an outage notice stay online on their own?
2. Who has authority to switch systems off during an incident, and who decides when they come back?
3. Do we have pre-approved answers to the concerns residents raise first, and do call center staff have them?
4. Which relief measures, such as late-fee waivers or shutoff pauses, can we announce on day one without a fresh vote or approval?
5. Do we know which customers are on medical-need registers, hardship programs or automatic payments, and how we would reach them directly?

With hindsight

American Water’s portal and billing were back within about a week, and the company reported no impact on water service. By the standards of cyber incidents, that was a contained episode. It is useful precisely because it was ordinary: it shows the shape of a utility incident when the worst does not happen, and that shape is the one most organizations are likeliest to face.

The episode joined other 2024 water sector incidents that kept federal attention on utility cybersecurity. That attention did not produce comprehensive federal cybersecurity requirements for water systems in 2025, so state rules and voluntary programs remained the main levers. Much of the responsibility for preparing therefore still sits locally, with utility boards and city leaders, and with whatever standards their state and their own governance set.

The customer-facing arc repeated through 2025 and 2026 in ransomware incidents at cities, counties and school districts: portals offline, payments and permits disrupted, relief announced, then notification letters months later. The details varied, but the sequence was remarkably consistent. Residents rarely saw the attacker. They saw closed services, heard (or did not hear) explanations, and waited for bills, permits and letters.

The design choice that most narrows that arc is still the first of the four: payment and information services that can keep running apart from the network under attack. It is a technical decision with a very public payoff. An organization that can keep taking payments and posting clear updates while it investigates gives residents fewer reasons to worry and staff fewer calls to answer.

The public judges a cyber incident by the response it can see. Much of that response, from which services stay up to which fees are waived, can be decided calmly in advance rather than improvised under pressure.