New York state lawmakers examined cybersecurity threats facing water and wastewater utilities during an Oct. 1 joint hearing focused on system vulnerabilities, new state requirements and the resources municipalities need to protect critical infrastructure.

The hearing brought together state cybersecurity officials, water industry representatives and infrastructure experts to discuss the growing risk of cyberattacks and implementation of New York’s 2026 cybersecurity regulations for water and wastewater systems.

New York State Chief Cyber Officer Meghan Cook told lawmakers that nation-state and affiliated actors are increasingly targeting critical infrastructure and using artificial intelligence to make attacks faster and more scalable. She also highlighted a series of July cyberattacks that reportedly affected more than 100 water and wastewater facilities across 12 states. Impacts included temporary loss of system access, a countywide boil water advisory and operators switching to manual operations. New York was not among the affected states.

Cook said some attacks exploited basic cybersecurity weaknesses, including poor password management. She emphasized foundational safeguards such as strong passwords, multifactor authentication and limiting unnecessary internet connections.

The state’s new regulations establish minimum cybersecurity requirements for water and wastewater systems, including risk assessments, incident reporting, cybersecurity training and protections for critical operations. New York officials described the rules as the first state regulations specifically addressing cybersecurity in the water and wastewater sector.

Michael P. Hale, executive vice president of the New York State Environmental Facilities Corporation, outlined financial assistance available through the state’s Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements (SECURE) grant program. The state has invested more than $9 million in cybersecurity projects serving 153 local governments.

Representatives from the New York Section of the American Water Works Association also raised concerns about staffing, technical expertise and the cost of maintaining cybersecurity protections.

The hearing was convened by the Senate committees on Local Government, Cities 1 and Cities 2 to assess whether municipalities have the support needed to meet the new requirements and protect reliable water service.