A coordinated cyber campaign targeted operational technology systems at water and wastewater facilities across multiple U.S. states, causing disruptions to automated control functions in some municipalities. New York State responded by awarding $9 million in grants to 153 local water systems to fund cybersecurity assessments and improvements under the SECURE grant program. The program supports compliance with newly introduced mandatory cybersecurity standards, including training, incident reporting, risk-based protections, and cybersecurity leadership roles. The attacks have been linked to Iranian threat actors based on similarities to previous campaigns. Federal guidance includes removing publicly exposed programmable logic controllers, changing default passwords, and securing remote access through VPNs or trusted IP restrictions. No New York utilities have been publicly affected by this campaign. The grants complement a larger state investment in water infrastructure.

The cyber campaign caused operational disruptions to water and wastewater systems in at least seven states, including shutdowns of control functions and temporary offline status of some facilities. Drinking water safety was reportedly maintained despite these disruptions. The attacks highlight vulnerabilities in operational technology controlling critical water infrastructure. The New York grants aim to mitigate these risks by funding cybersecurity improvements and enforcing minimum security standards. No direct impact on New York water systems has been reported publicly. The campaign underscores the ongoing threat to critical infrastructure from state-linked threat actors.

The New York State SECURE grant program provides funding for cybersecurity assessments and implementation of security upgrades at local water utilities. Utilities are required to comply with mandatory cybersecurity standards including operator training, incident reporting, risk-based protections, and cybersecurity leadership designation. Federal agencies recommend removing publicly exposed operational technology devices from the internet, changing default passwords, routing remote access through secure gateways or VPNs, and restricting connections to trusted IP addresses. These measures should be implemented to reduce exposure to similar attacks. The grants and standards represent proactive mitigation efforts; no urgent remediation is indicated for New York utilities at this time.