Many of the weaknesses involved operational technology, the digital controls that manage drinking water treatment and wastewater processes. These systems are increasingly attractive targets for hackers because a successful breach can disrupt service, contaminate supplies, or force shutdowns that ripple across communities and local economies.

EPA says it eliminated roughly 350 vulnerabilities last year alone, leaning heavily on what it describes as low-cost or even free cybersecurity practices. Things like asset inventories, reducing internet-facing controls, and using multi-factor authentication may sound basic, but they remain surprisingly absent in many utilities, particularly smaller ones with limited IT staff.

The agency isn’t working alone. It has partnered with groups like the Cybersecurity and Infrastructure Security Agency, along with state agencies and water sector associations, to push cybersecurity best practices and offer free assessments and technical support.

And the concern is real. Federal cybersecurity agencies have repeatedly warned that U.S. infrastructure is facing rising digital threats. In recent years, water and wastewater utilities have been among the sectors targeted by ransomware groups and foreign-linked hackers. Publicly reported incidents now number in the hundreds annually across U.S. critical infrastructure, with utilities increasingly showing up on that list. While not every attack succeeds, even failed intrusions expose vulnerabilities that could be exploited later.

Still, some industry voices caution that cybersecurity requirements can feel overwhelming, especially for small rural systems already stretched thin by aging infrastructure and staffing shortages. Implementing new digital protections takes time, training, and sometimes outside expertise, even when the tools themselves are inexpensive.

To help offset those challenges, EPA announced more than $9 million in grant funding last August for midsize and large water systems aimed at boosting cybersecurity and improving resilience to extreme weather events. The agency has also released new online tools and a report outlining ten recommendations for strengthening cyber defenses across the sector.

Supporters say the investment is overdue. As water systems become more automated and interconnected, the digital risks rise right alongside efficiency gains.

Critics, however, warn that funding and guidance alone may not be enough. Many utilities still lack dedicated cybersecurity staff, and without long-term investment, vulnerabilities could continue to outpace protections.

What’s clear is that cybersecurity has officially joined the list of essential water system responsibilities, right alongside water quality testing and infrastructure maintenance. The days when cyber threats could be brushed off as an IT problem are long gone.

For water utilities, the message is simple but serious: protecting public health now means protecting digital systems too.