EPA addresses hundreds of cybersecurity vulnerabilities at U.S. water systems in 2025
The U.S. Environmental Protection Agency is highlighting new progress made in 2025 to strengthen cybersecurity across the nation’s drinking water and wastewater systems.
According to EPA, the agency’s Office of Water proactively identified cybersecurity vulnerabilities at 277 water systems and worked directly with utilities to address the issues through tailored solutions. These fixes ranged from improved authentication protocols and stricter access controls to technical updates targeting operational technology used to control water and wastewater treatment processes. EPA said it eliminated 350 cybersecurity vulnerabilities in total during 2025.
“Access to clean and safe water is foundational to healthy people and environmental protection, thriving businesses, domestic manufacturing, AI, and agricultural production,” said EPA Assistant Administrator for Water Jess Kramer in an EPA press release. “The threat of cyberattacks is a relatively new and growing concern that water systems must proactively address.”
EPA noted that many of the identified weaknesses involved critical system components that could be attractive targets for cyber threat actors, making mitigation efforts essential for protecting public health and economic activity. Kramer emphasized that many cybersecurity improvements are “free or low-cost practices that can make a real difference.”
The agency is working in coordination with the Cybersecurity and Infrastructure Security Agency, states and water sector associations to reduce cyber risk. EPA continues to encourage utilities to adopt basic cybersecurity best practices, including limiting public internet exposure of operational technology, maintaining asset inventories and implementing strong password and multi-factor authentication protocols. EPA also provides free cybersecurity assessments and technical assistance to support implementation.
In August, EPA announced more than $9 million in grant funding for midsize and large water systems to help protect drinking water from cybersecurity threats while also improving resilience to extreme weather events. The agency has also published a report outlining 10 recommendations to strengthen cyber resilience and released new online cybersecurity tools for water systems in October 2025.