The Environmental Protection Agency announced $11.75 million in cybersecurity grants targeting midsize and large drinking water systems across multiple states to strengthen defenses against cyberattacks and extreme weather disruptions, on Aug. 31.
Drinking water infrastructure has been identified as a priority target for foreign cyber actors, including nation-state hackers, making federal investment in utility-level defenses an urgent public health and national security priority.
State-specific awards include $5.2 million for California, $2.375 million for Indiana, $1.125 million for Colorado, $1.2 million for the Southeast region and $687,000 for Kansas, the EPA said.
The grants are designed to help water utilities meet federal cybersecurity standards for critical infrastructure and build resilience against both digital attacks and physical threats from extreme weather events.
The Cybersecurity and Infrastructure Security Agency has repeatedly warned that water and wastewater systems are among the most vulnerable segments of U.S. critical infrastructure to cyberattacks. Several incidents in recent years have demonstrated that hackers can gain access to treatment systems and manipulate chemical dosing levels.
A 2021 incident in Oldsmar, Florida, in which an intruder remotely accessed a water treatment facility and attempted to increase sodium hydroxide levels to dangerous concentrations, highlighted the potential consequences of inadequate cybersecurity at water utilities.
Many midsize water systems lack dedicated cybersecurity staff and rely on the same information technology infrastructure used for routine operations, creating single points of failure that attackers can exploit.
The EPA grants will fund vulnerability assessments, security upgrades, staff training and resilience planning at recipient utilities. Water utilities serving tens of millions of Americans across the awarded states will benefit from the funding.