Loading story…
New York has expanded its effort to protect drinking water and wastewater systems by pairing statewide cybersecurity requirements with more than $9 million in SECURE grant funding for 153 utilities. State officials said the program supports cybersecurity assessments, security upgrades, operator training, incident reporting, and risk-based protections, while requiring larger drinking water systems to designate cybersecurity leads. The initiative builds on regulations issued by the Departments of Environmental Conservation and Health and is administered through the Environmental Facilities Corporation with technical assistance for local communities.
The funding push comes as U.S. water infrastructure faces heightened operational technology threats. A recent multistate campaign targeted more than 30 community water systems in Minnesota, with additional incidents reported in at least seven states including Michigan, South Dakota, and Georgia. Federal investigators have not formally attributed the activity, but Iran is considered a leading suspect because the tactics resemble earlier operations against industrial control systems and water utilities. In response, CISA urged operators to remove internet-exposed PLCs and strengthen remote access and password security.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The campaign against Minnesota community water systems continued on a second day, with attacks also tied to broader impacts across at least seven states. Most affected facilities remained operational through contingency procedures.
More than 30 community water systems in Minnesota were targeted in a coordinated cyber campaign against water and wastewater operational technology systems. Some municipalities reported disruptions to automated controls, and Braham briefly took its water plant offline after attackers shut down operating controls.
Governor Kathy Hochul announced new statewide cybersecurity regulations for New York drinking water and wastewater systems and launched the SECURE grant program with $2.5 million in funding. The standards include operator training, incident reporting, risk-based protections, and cybersecurity lead roles for larger drinking water systems, and applications opened that day.
New York announced more than $9 million in SECURE grant funding for 153 drinking water and wastewater systems to support cybersecurity assessments, security upgrades, and technical assistance. The funding was described as helping utilities comply with the minimum cybersecurity standards introduced in March.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
statescoop.com
Open sourcesecurityweek.com
Open sourcegovernor.ny.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
New York finalized **cybersecurity regulations** for water and wastewater organizations, requiring covered utilities to implement baseline protections and prepare for disruptive cyber incidents. The rules include **incident reporting**, **incident response and recovery planning**, mandatory cybersecurity training for certified operators, and designation of a cyber lead for larger utilities. Coverage applies to community water systems serving more than 3,300 people, with additional obligations for larger organizations, as state officials cited escalating threats to the sector and the need to act despite stalled federal mandates. The requirements also call for written **vulnerability management** procedures, stronger access controls such as **multi-factor authentication**, bans on default credentials, and segmentation of **operational technology** from IT and external networks; larger facilities must also conduct network monitoring and logging. To support compliance, the state launched a **$2.5 million grant program** and technical assistance effort, with funding available for cybersecurity evaluations and defensive upgrades. The measures were framed as a response to persistent targeting of water infrastructure, including campaigns linked to **China** and **Iran**, and as an effort to improve resilience and continuity of operations during cyberattacks.
Jun 29, 2026
U.S. policymakers are advancing new cybersecurity measures for the **water and wastewater sector**, with separate federal and state initiatives aimed at improving defenses for under-resourced utilities. A bipartisan federal proposal, the **FLOWS Act**, would provide the Environmental Protection Agency with **$50 million annually** to help small and rural water systems modernize cybersecurity capabilities, digital monitoring, and operational technology support without requiring local cost sharing that often blocks access to federal aid. In New York, state officials finalized what they describe as **first-of-its-kind cyber mandates** for public water systems and paired them with a **$2.5 million grant program** to support risk assessments and security upgrades. The rules establish enforceable requirements for drinking water and wastewater operators to create formal cybersecurity programs, identify risks, and implement technical safeguards for operational systems, reflecting broader concern that the water sector remains a comparatively weak point in U.S. critical infrastructure security.
Jun 30, 2026
Senators Adam Schiff and Amy Klobuchar introduced a comprehensive cybersecurity bill aimed at strengthening protections for U.S. water infrastructure after recent cyberattacks on water systems. The legislative push follows longstanding federal concern over the sector’s weak cyber posture, including a **GAO** finding that the **EPA urgently needs a strategy** to address cybersecurity risks across water and wastewater systems, underscoring gaps in oversight, coordination, and resilience for a critical public service. The move comes as sector-specific defenders continue to warn utilities about exploitable flaws in widely used technology. **WaterISAC** highlighted several high-priority vulnerabilities for water and wastewater operators, including `CVE-2026-8037` in **Progress LoadMaster** (unauthenticated OS command injection leading to remote code execution), `CVE-2026-68820` in **Microsoft Windows** (privilege escalation), `CVE-2026-72898` in **Metabase** (SQL injection that can enable unauthenticated administrator access), and `CVE-2026-19516` in **Grafana MCP Server** (server-side request forgery), noting that multiple issues are listed in **CISA’s Known Exploited Vulnerabilities** catalog.
Aug 14, 2026