Water Sector Cyber Statistics: Utility Incidents, Exposed HMIs and Inspection Findings

Water utility cyber risk is discussed with dramatic claims, yet the figures that regulators and auditors have actually published are few, specific and far more useful than the headlines built on them. This page brings together the primary statistics on drinking water and wastewater cyber security: the US Environmental Protection Agency (EPA) enforcement alert on inspection findings, the EPA Office of Inspector General (OIG) passive assessment of 1,062 large drinking water systems, the US Government Accountability Office (GAO) review of EPA's approach, the joint advisory on the CyberAv3ngers campaign against Unitronics controllers, and the UK Drinking Water Inspectorate (DWI) findings under the NIS Regulations. Every figure carries its publisher, report and period in the same sentence or table row, and derived figures are labelled as calculated. It is for utility security leads, OT engineers, regulators' liaison staff and risk teams who need defensible numbers. The regulatory detail is in the EPA Water Sector Cybersecurity Requirements Guide, which this page does not repeat. Last reviewed: November 2026.

Key takeaways

• Most inspected US utilities failed basic requirements. EPA's May 2024 enforcement alert states that over 70% of systems it inspected since September 2023 were in violation of basic Safe Drinking Water Act (SDWA) Section 1433 requirements.
• Large systems show visible weaknesses from outside. The EPA OIG passive scan of 8 October 2024 found 97 of 1,062 large drinking water systems with critical or high risk vulnerabilities, serving about 26.6 million people.
• The failures are identity failures. EPA's inspection examples are default passwords, a single login shared by all staff, and former employees who still had access; the CyberAv3ngers campaign succeeded against default or absent passwords.
• Scale defeats uniform regulation. GAO counts nearly 170,000 water systems in the United States and found workforce gaps, legacy technology and voluntary investment as barriers.
• Published incident counts are scarce. Neither EPA nor the DWI publishes an annual count of water cyber incidents, so treat any precise national incident total without a named primary source with caution.

How to read water cyber statistics

The water figures that can be traced come from three kinds of source, and they measure different things.

Two definitions matter. A community water system under SDWA Section 1433 is one serving more than 3,300 people, so the EPA inspection figures say nothing about the many smaller systems. Wastewater utilities are regulated under different law and are outside the 1433 figures entirely. Vendor threat reports also cover water, but often as part of a wider industrial sample; the cross-sector industrial figures are in the OT and ICS Security Statistics Guide.

Headline statistics

Inspection and compliance findings

• Violation rate: EPA's enforcement alert (issued May 2024, page updated July 2026) states that over 70% of the systems EPA inspected since September 2023 were in violation of basic Section 1433 requirements. Section 1433, as amended by America's Water Infrastructure Act of 2018, requires community water systems serving more than 3,300 people to complete a risk and resilience assessment and an emergency response plan.
• What inspectors found: the same alert lists systems that had not changed default passwords, systems where all staff used a single login, systems where former employees kept access, and assessments or plans that left out the resilience of cyber security strategies and resources.
• Enforcement volume: EPA states it has taken over 100 SDWA enforcement actions nationally against community water systems for Section 1433 violations since 2020.
• Policy history: GAO records that EPA interpreted existing legal requirements in March 2023 to include cybersecurity assessments at drinking water systems and withdrew that interpretation seven months later after legal challenges. Inspection figures should be read against that background: there is no federal requirement for a specific set of cyber controls at US water systems.

Exposure and vulnerability findings

• Scale of the scan: the EPA OIG Management Implication Report 25-N-0004 (13 November 2024) describes a passive assessment of 1,062 drinking water systems each serving 50,000 or more people, together serving over 193 million people, with scan results as of 8 October 2024.
• Critical and high findings: 97 systems, serving approximately 26.6 million users, had critical or high risk vulnerabilities. Calculated from the report's figures, that is about 13.8% of the population covered.
• Medium and low findings: a further 211 systems, serving over 82.7 million people, had medium or low risk issues, which the report associates with externally visible open portals.
• Categories examined: the report groups findings into email security, IT hygiene, vulnerabilities, adversarial threats and malicious activity. It does not separate IT from OT exposure, so do not quote it as a count of exposed control systems.
• Internet exposed HMIs: the joint EPA and CISA fact sheet of 13 December 2024 on internet exposed human machine interfaces cites 2024 pro-Russia hacktivist incidents at water and wastewater systems, without a count. Its recommended actions start with inventorying internet exposed devices and disconnecting HMIs from the public internet where possible.

The OIG figures are a lower bound on weakness, since a passive scan sees only what is reachable from the internet. They are also a snapshot: an organisation using them in a board paper should state the scan date.

Incidents and campaigns

• CyberAv3ngers and Unitronics controllers: joint advisory AA23-335A (first released 1 December 2023, updated 14 December 2023 and 18 December 2024) attributes the campaign to an IRGC-affiliated persona. It reports at least 75 US-based Unitronics PLCs compromised between November 2023 and January 2024 in about four waves, at least 34 of them in the water and wastewater sector. The devices were reachable on their default TCP port 20256 and had a default password or none; the actors changed the port to 20257 to hinder operator access. See the CyberAv3ngers Threat Actor Profile and the PLC Security Guide.
• Pro-Russia hacktivist activity: CISA, FBI, NSA, EPA, DOE, USDA, FDA, MS-ISAC, the Canadian Centre for Cyber Security and NCSC-UK name water and wastewater as a targeted sector in their joint guidance on pro-Russia hacktivist activity against OT, describing mostly unsophisticated techniques that manipulate ICS equipment to cause nuisance effects. The guidance gives no incident count.
• Threat context: GAO-24-106744 states that the sector faces growing risk from nations including Iran and China and from cybercriminals, and that foreign hackers targeted multiple water systems in late 2023.

Oversight and regulator findings

• GAO on EPA: GAO-24-106744 (1 August 2024) found that EPA had assessed parts of the sector's cyber risk but had not combined them into a sector wide risk assessment or a risk-informed strategy, and made four recommendations. As shown on GAO's page when checked in November 2026, the risk assessment and strategy recommendations are closed as implemented, the evaluation of legal authorities is open and partially addressed, and independent peer review of EPA's Vulnerability Self-Assessment Tool (VSAT) is open.
• Barriers named by GAO: workforce skills gaps, older technology that is hard to update, and limited investment because cyber security improvements are voluntary while clean and safe water requirements are mandatory.
• UK DWI under NIS: the DWI's Drinking Water 2024 report states that every water company in England was subject to an Inspectorate cyber resilience audit between 2023 and 2024, verifying the companies' self-assessed Cyber Assessment Framework (CAF) returns, and that two companies were issued legal notices to improve their risk assessments. Every company in England and Wales also has a regulation 18 notice covering residual cyber risk and its PR24 cyber improvement plan. Companies map their resilience against 39 CAF contributing outcomes, and the DWI has received an annual CAF return from each in-scope company since 2018.

Where identity fits

Read together, the published water figures point at identity more than at exotic malware. Default credentials, shared accounts and retained leaver access are the three named inspection findings, and the most widely reported campaign against US water systems relied on default or absent passwords on internet reachable controllers. Vendor and integrator remote access adds non-human and third party accounts that rarely appear in a utility's directory. Practical guidance is in the Default Credential Breaches Lessons Guide, the Joiner-Mover-Leaver Guide and the OT Remote Access Guide.

What the numbers mean for defenders

1. Start with credentials: audit every HMI, PLC programming interface and remote access path for default, shared and orphaned accounts. This addresses each of the EPA inspection examples.
2. Find your external exposure before others do: the OIG scan shows that weaknesses at large systems are visible from the internet. The EPA and CISA HMI fact sheet points utilities to CISA's free vulnerability scanning service.
3. Put cyber into the statutory cycle: for US community water systems, make sure the Section 1433 risk and resilience assessment and emergency response plan cover cyber security, since omission was itself an inspection finding.
4. Log remote access: the HMI fact sheet recommends logging remote HMI logins and watching for failed attempts and unusual access times.
5. Measure progress: track the number of default credentials found per site audit, internet reachable OT assets, OT accounts without a named owner, leaver accounts disabled within one working day, and remote access sessions without MFA.

The sector programme as a whole is set out in the Water and Wastewater Cybersecurity Guide.

Framework mapping

Common mistakes when using water statistics

• Quoting the OIG scan as a count of hacked utilities: it measured externally visible weaknesses, not compromises.
• Applying the 70% inspection figure to all US water systems: it covers systems EPA inspected since September 2023, under a law that applies only to community water systems serving more than 3,300 people.
• Adding drinking water and wastewater together: the figures above are mostly drinking water only; wastewater sits under different law.
• Dropping the "at least": the CyberAv3ngers counts are minimums from reported cases.
• Citing secondary roundups: several widely shared water incident totals cannot be traced to a regulator or official report. Use the primary source or leave the figure out.

Practitioner checklist

• Cite each water figure with publisher, report number and date, and state the period it covers.
• Label any percentage you calculate yourself as calculated.
• Audit HMIs, PLCs and remote access for default, shared and orphaned accounts at every site.
• Inventory internet reachable OT and IT assets and remove direct exposure of control interfaces.
• Include vendor and integrator accounts in the leaver and access review process.
• Confirm the Section 1433 assessment and response plan, or the NIS CAF return in the UK, address cyber security explicitly.
• Log and review remote HMI logins and failed attempts.
• Recheck EPA, GAO, CISA and DWI pages at each review, since recommendation status and guidance change.

Standards and references

• US EPA: Enforcement Alert, Drinking Water Systems to Address Cybersecurity Vulnerabilities
• EPA Office of Inspector General: Report 25-N-0004, Cybersecurity Concerns Related to Drinking Water Systems
• US GAO: GAO-24-106744, EPA Urgently Needs a Strategy to Address Cybersecurity Risks to Water and Wastewater Systems
• CISA: AA23-335A, IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors
• US EPA and CISA: Internet-Exposed Human Machine Interfaces fact sheet
• CISA: Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity
• Drinking Water Inspectorate: Drinking Water 2024, Network and Information Systems
• US EPA: Cybersecurity for the Water Sector

Related NHI Mgmt Group resources: EPA Water Sector Cybersecurity Requirements Guide · Water and Wastewater Cybersecurity Guide · OT and ICS Security Statistics Guide · CyberAv3ngers Threat Actor Profile