The U.S. Environmental Protection Agency (EPA) has announced a $9.5 million (Rs. 83 Crores) grant initiative aimed at helping public water systems strengthen their defences against cyber threats. However, experts from the Foundation for Defence of Democracies (FDD) caution that the effort is insufficient in the face of escalating attacks on America’s water infrastructure.
Unveiled during a webinar, the program is one of the first federal attempts to directly bolster cybersecurity in drinking water utilities. It will provide funding to six midsize and large water systems, allowing them to enhance resilience through cybersecurity tools, incident response planning, or physical upgrades. Yet, the limited scope and eligibility restrictions have sparked concern among analysts and industry leaders.
Data Protection and DPDP Act Readiness: Hundreds of Senior Leaders Sign Up for CDPO Program
Smaller Utilities Left Behind
Community water systems serving fewer than 10,000 people are excluded from the initiative. These smaller utilities account for 90 per cent of U.S. systems and provide water to 46 million Americans, making them among the most vulnerable to digital threats. Many of these utilities lack the budgets and in-house expertise to deploy effective cybersecurity measures.
FDD researchers Sophie McDowall and Maria Riofrio noted that cyberattacks on water infrastructure are already widespread. In recent years, Iranian, Russian, and Chinese hackers have breached U.S. utilities, disrupting operations and forcing manual control. A 2024 Inspector General report found that nearly 100 drinking water systems serving more than 26 million people had serious cybersecurity vulnerabilities, including default passwords and unpatched software.
Growing National Security Risk
Experts warn that a coordinated ransomware attack could simultaneously disrupt water supply, treatment, and distribution nationwide, with cascading impacts on healthcare, agriculture, and daily life. Mark Montgomery, senior director of FDD’s Centre on Cyber and Technology Innovation, argued that the new funding is “only a drop in the bucket” compared to what is required to secure the sector.
Some states are moving faster. New York recently launched a $2.5 million (Rs. 21 Crores) program supporting utilities serving populations between 3,300 and 50,000. While smaller in size, it is explicitly dedicated to cybersecurity upgrades, something the EPA’s program does not guarantee.
Industry representatives stress that federal aid must prioritize rural and small systems, with some lawmakers proposing a “cyber circuit rider” program to deliver direct expertise. Without dedicated resources, experts warn, America’s water utilities will remain dangerously exposed to state and criminal cyber actors.
