August 2026 AWWA Water Utility Insider

Cybersecurity attack targeted multiple water systems in 12 states

The recent cybersecurity attacks targeting U.S. water operational technology is the largest publicly reported multi-state cyber campaign. These incidents primarily occurred July 26-27, roughly four days after a joint advisory warning the water sector of attacks targeting programmable logic controllers (PLC) with public internet connections. Systems in at least 12 states have been impacted based on public reporting, with at least 30 in Minnesota.

The targeted PLCs in many cases were connected to the internet via open cellular network connections. Attackers changed the IP address or password on PLCs, blocking operators’ ability to manage or communicate with devices. Reported consequences included:

• Loss of monitoring and control functionality.
• Temporary manual operation of water and wastewater facilities.
• Communications outages affecting towers and lift stations.
• Water pressure loss.
• Flooding at some facilities.
• Boil-water advisories in some locations.

AWWA’s advisory highlighted mitigation recommendations from federal partners, which specifically called for immediate action to address potential vulnerabilities. Those recommendations are as follows:

• Water utilities are advised to immediately verify access control protocols to ensure devices are not internet accessible.
• System integrators and service providers are advised to support utility clients in verifying that access controls have been properly implemented.

In addition, AWWA’s statement and letter to Congressional leadership advocating for support and resources for water systems was covered by multiple national media outlets.

Webinar on “Targeted Cyber Mitigations for Rapid Response” set for Aug. 25

AWWA will host a free webinar, “Targeted Cyber Mitigations for Rapid Response” on Tuesday, Aug. 25 from 11 a.m. until 12:30 p.m. MT. The webinar will focus on risk management actions utilities can implement to immediately lower risk exposure from targeted attacks impacting water systems. Experienced practitioners will address how to identify if the system is exposed, provide plain English steps to remove devices from the internet and provide secure access, manage default passwords on devices and implement multifactor authentication. This session is being provided to share practical, low-cost solutions that can be implemented directly to mitigate known vulnerabilities that have impacted water systems of all types and size.

Fluoride health effects assessment advances

EPA’s Office of Groundwater and Drinking Water continues to advance the assessment of the health effects associated with fluoride in drinking water, which was first promised in April 2025. On Aug. 3, the agency released its Protocol for Developing the Fluoride Human Health Toxicity Assessment. This follows the EPA taking comment in January on its Preliminary Assessment Plan and Literature Survey. The protocol document includes a summary response to the comments received; the agency indicates it will continue its intended path forward, opting not to complete a full assessment. Instead, EPA will accept prior work by other agencies stating that fluoride exposure has neurodevelopmental health effects. The agency will now review the available human studies literature and conduct a dose-response analysis to determine the exposure levels at which harmful effects occur both for adverse dental fluorosis and neurodevelopment effects. EPA is maintaining a Fluoride in Drinking Water webpage. EPA did not provide a timeline for completion of the planned analysis but has advanced this work much faster than is typical.

EPA urges preparation for UCMR 6

This week, EPA held two webinars explaining its Sixth Unregulated Contaminant Monitoring Rule (UMCR 6) proposal and steps water systems and laboratories involved will need to take between now and January 2028 to prepare. Altogether, more than 10,550 water systems are expected to participate in this data collection effort. This is a logistical challenge for EPA, making engagement well before deadline dates critical.

Laboratories seeking approval to process UCMR 6 samples for large systems — or interested in contracting with EPA to process small systems samples — were encouraged to begin as soon as possible to participate in proficiency testing study rounds. Laboratories can also look at the UCMR 6 docket for the UCMR 6 Laboratory Approval Manual (Version 1.0). EPA anticipates that complete laboratory approval applications must be submitted by August 2027 to successfully obtain approval prior to the start of monitoring.

Water systems will need to ensure they have access to the Safe Drinking Water Accession and Review System (SDWARS) and that the data there is correct. Systems with multiple groundwater source points-of-entry and multiple wholesale water connections can prepare plans for representative sampling. EPA is contacting systems that have previously used representative groundwater monitoring for confirmation of system intention in UCMR 6. Systems that do not respond will see their full inventory of groundwater sample sites uploaded into SDWARS. Systems using a representative wholesale water connection will not need EPA approval but will need to ensure the sample location is in SDWARS.
 

EPA releases checklist for identifying systemic issues at water systems

EPA and ASDWA released a checklist for state drinking water capacity development programs and sanitary survey programs. The checklist is aimed at spotting systems before their technical, managerial, and financial capacity degrades to a level that poses a risk to water service reliability or public health. The new checklist and other EPA resources for states are available on EPA's sanitary survey and capacity development state resource webpages. The guidance notes that “Early identification of systemic issues can lead to quicker resolutions and implementation of long-term solutions where appropriate. Checklist items are incorporated into each of the eight required areas addressed in sanitary surveys extending from source to operator certification compliance (40 CFR 142.16(b)(3)).

EPA addressing sector workforce challenges

In April, EPA announced that it would revitalize the prior Trump administration’s water workforce initiative. On Aug. 4, EPA convened a cross-section of agency, state, and non-governmental organizations at a roundtable called Strengthening the Water Sector Workforce. The roundtable dialogue acknowledged that pay scales must be competitive with other comparable employment opportunities to attract workers. Themes that arose included creating remote learning opportunities like the Veolia Academy, the National Rural Water Association’s efforts to build a workforce through apprenticeships and learning from efforts to advance inter-state operator certification reciprocity.

FEMA, USGS release reports on earthquake and tsunami hazards

The Federal Emergency Management Agency (FEMA) and the U.S. Geological Survey (USGS) have updated “FEMA P-366: Hazus Estimated Average Annualized Losses for Earthquakes in the United States and its Territories” report, detailing the latest average annualized losses across the United States. For the first time, the report includes seismic data for American Samoa, the Commonwealth of the Northern Mariana Islands, and Guam. An interactive version of the report’s data is available, allowing users to easily visualize findings for their specific area at the state, county, metropolitan, and U.S. Census tract levels.

FEMA also published “FEMA P-2426: Estimated Average Annualized Tsunami Losses for the United States,” a first-of-its-kind study assessing the risk of tsunamis. The study highlights the significant tsunami risk faced by coastal communities to help emergency managers plan investments and mitigation measures.

U.S. Senate passes Continuing Resolution, setting stage for September negotiations with House

Before leaving for August recess, the U.S. Senate agreed to a Continuing Resolution (CR) that would provide government funding through Dec. 11, if enacted. The Senate CR differs from the U.S. House-passed CR, which was strictly limited to extending government funding through Dec. 4. Notably, the Senate CR includes a provision that would prohibit the implementation of the Office of Management and Budget’s “Regulation for Federal Financial Assistance” (as issued in May 2026) for the duration of the CR.

When Congress returns from recess in September, House and Senate negotiators will have limited working days to reach agreement on the terms of a CR before current funding expires Sept. 30. Both chambers will likely want to reach an agreement to avoid a government shutdown shortly before the midterm elections in November, though it is difficult to predict whether any policy items (like the delay of the OMB rule) will be included in the final product.