New York is awarding more than $9 million to help 153 drinking water and wastewater systems strengthen their defenses against cyberattacks.
Governor Kathy Hochul announced the funding Monday through the state’s Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements (SECURE) grant program.
The grants will fund cybersecurity assessments and the implementation of security improvements at local utilities. Recipients will also have access to no-cost technical assistance from the New York State Environmental Facilities Corporation (EFC).
The funding is intended to help utilities comply with minimum cybersecurity standards introduced by New York in March. Those standards include mandatory cybersecurity training for certified operators, incident reporting requirements, risk-based protections for critical operations and sensitive information, and the designation of a cybersecurity lead at larger drinking water systems.
When the SECURE program was launched, New York said utilities could receive up to $50,000 for cybersecurity assessments and up to $100,000 for implementing security upgrades.
“These threats are real and escalating,” Hochul said, pointing to the recent cyberattacks against water systems in multiple states.
The funding announcement comes shortly after a coordinated cyber campaign targeted operational technology systems at water and wastewater facilities across the United States. More than 30 community water systems in Minnesota were targeted on July 26 and 27.
Some municipalities reported disruptions to automated control functions, although contingency procedures allowed most facilities to remain operational.
The city of Braham briefly took its water plant offline after attackers shut down operating controls, stopping the well and water treatment plant. Other affected municipalities said their drinking water remained safe and services continued operating.
The campaign was subsequently found to have affected water infrastructure in at least seven states.
Michigan confirmed malicious activity involving a small number of communities, while Rapid City, South Dakota, reported an incident involving a wastewater lift station. Georgia was also reportedly among the states targeted. No New York utility has been publicly linked to the campaign.
Federal investigators have not formally attributed the attacks. However, Iran has emerged as a leading suspect because the activity reportedly resembles previous campaigns linked to Iranian threat actors known to target industrial control systems and water utilities.
Following the attacks, the US Cybersecurity and Infrastructure Security Agency (CISA) urged water and wastewater operators to remove publicly exposed programmable logic controllers and other operational technology from the internet.
The agency also recommended changing default passwords, routing necessary remote access through secure gateways or virtual private networks, and restricting connections to trusted IP addresses.
The $9 million in cybersecurity grants is separate from a five-year, $3.8 billion clean water infrastructure investment included in New York’s fiscal year 2027 budget. The state said that investment will bring its total water infrastructure grants since 2017 to more than $10 billion.
Related: US Water Cyberattacks Extend Beyond Minnesota to at Least 6 Other States
