Senate Committees Examine Water Infrastructure Cybersecurity and Emerging Threats During Joint Hearing

“Adversaries only need to succeed a few times, while our defenders must succeed all the time.” That warning from New York State Chief Cyber Officer Meghan Cook underscored the challenge facing the state’s water and wastewater systems as the State Senate examined the growing threat of cyberattacks against critical water infrastructure during a joint hearing Thursday.

The hearing, convened by the Senate Standing Committees on Local Government, Cities 1 and Cities 2 and chaired by Sens. Monica R. Martinez, Erik Bottcher and Chris Ryan, examined the vulnerabilities facing municipal water systems, the implementation and impact of New York’s new cybersecurity requirements, and whether local systems have the resources and technical support necessary to protect against evolving threats.  

Cook told lawmakers that nation-state and affiliated cyber actors are increasingly targeting critical infrastructure and using artificial intelligence to make attacks faster and more scalable.  She pointed to a coordinated series of cyberattacks in July that affected more than 100 water and wastewater facilities across 12 states, with impacts including temporary loss of system access, a countywide boil water advisory and a need for some operators to switch to manual operations.

While New York was not among the states affected, Cook said the attacks demonstrated the importance of continuing to strengthen the state’s defenses.  She noted that many of the attacks exploited basic cybersecurity weaknesses, including poor password management, underscoring the importance of foundational protections such as strong passwords, multifactor authentication and limiting unnecessary internet connections.

“New York’s water and wastewater systems are among the most essential infrastructure our communities depend on and protecting them requires us to stay ahead of threats that are becoming more sophisticated and more accessible,” said Sen. Martinez.  “This hearing gave us an opportunity to hear directly from the state’s cybersecurity leadership, water experts and system operators about the vulnerabilities they face and the resources they need to strengthen their defenses.”

The hearing also examined New York’s new cybersecurity requirements for water and wastewater systems, adopted by the state Department of Health and Department of Environmental Conservation in 2026.  The regulations establish minimum cybersecurity standards, including risk assessments, incident reporting, cybersecurity training and protections for critical operations.  New York was the first state to establish cybersecurity regulations specifically for the water and wastewater sector.

Michael P. Hale, executive vice president of the New York State Environmental Facilities Corporation, detailed the financial assistance available to help local governments implement those requirements.  The state has invested more than $9 million in cybersecurity projects serving 153 local governments through the Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements, or SECURE, grant program.

Lauryn Williams, deputy director and senior fellow in the Strategic Technologies Program at the Center for Strategic and International Studies (CSIS), testified that water infrastructure remains an attractive target for nation-state threat actors because disruptions can have consequences that extend far beyond a single utility.

Williams said the recent attacks demonstrated that sophisticated technology is not always required to disrupt water systems and urged critical infrastructure operators to assume they are potential targets and take steps to strengthen their defenses.

Representatives from the New York Section of the American Water Works Association also discussed the challenges local water systems face in meeting cybersecurity requirements, including staffing, technical expertise and the cost of maintaining increasingly complex systems.

“Cybersecurity is only as strong as the systems and people responsible for putting those protections into practice,” Martinez said.  “The testimony we heard will help us identify where additional support may be needed so municipalities can meet these requirements and keep the water services their residents rely on secure and reliable.”

The joint hearing was held Oct. 1 in the Senate Hearing Room in New York City.  Video of the hearing is available here.