At American Water, containment was the part customers saw
The largest U.S. water utility kept water flowing after a cyberattack, but switching off its billing portal was the incident as the public experienced it. For utilities and agencies, the customer-facing response is four decisions, and most can be made in advance.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
American Water Works is the largest regulated water and wastewater utility in the United States. On October 7, 2024, it disclosed in a filing with the Securities and Exchange Commission that it had detected unauthorized activity in its computer networks on October 3. As a precaution it disconnected or deactivated certain systems, including its MyWater customer portal, and paused billing. The company said it did not believe its water or wastewater facilities had been affected, and that customers would not be charged late fees while billing was paused. It notified law enforcement and engaged outside specialists. On October 10 it said the portal was operating again and billing was resuming. The incident followed a period of federal concern about water sector cybersecurity, including an EPA enforcement alert in May 2024 that urged utilities to address basic vulnerabilities.
After a cyberattack on critical infrastructure, the first question is whether the physical service is safe. American Water said its water was. For its customers, the incident was something else: a portal that would not load and bills that stopped arriving. That pattern repeats across municipal utilities, counties and agencies. When an organization takes systems offline to contain an attack, the public experiences the containment far more than the attack itself.
That makes the customer-facing response part of incident management, with the same planning discipline as forensics or recovery. It consists of four decisions, taken roughly in sequence: what to switch off, what to tell people, how to make them whole, and how to bring them back. Each has a different owner, and together they cover everything the public sees from the first hour to the last notification letter.
What to switch off
Disconnecting customer-facing systems is often the right containment step, especially when portals share infrastructure, identity services or credentials with internal networks. The decision has public consequences. Payments stop, applications stall and people cannot see their accounts or service status.
Architecture determines how much choice there is. A payment page hosted separately, with its own credentials and no network path into the core environment, may be able to stay online when everything else goes dark. So can a static outage page that does not depend on the content management system behind the main website. Utilities and agencies should know, before an incident, which public services depend on which internal systems and which could run in isolation. The aim is a targeted switch-off instead of an all-or-nothing one.
The decision also needs an owner and criteria for reversal. In many incidents, systems are disconnected by whoever is on the response call and then stay off longer than necessary because nobody is responsible for deciding when they can return. A short decision log, recording what was switched off, why and what evidence would justify restoring it, helps both the response and the review afterward.
What to tell people
Within hours, residents call, post and ask. Silence gets filled by others, often inaccurately. Early statements must still be careful: facts are uncertain, law enforcement may be involved, and promises about data or timelines can turn out wrong.
The practical answer is pre-approved templates for the questions people ask. Is my water, benefit or service affected? Do I need to do anything? Will I be penalized? Is my personal information at risk? When will this be fixed? Each answer can be drafted in advance, cleared by counsel and leadership, and completed with specifics in minutes. It should go out on the website, phone lines, social media and local media together. Call center agents and front-desk staff need the same script on the same day, or the public hears several versions.
For a listed company such as American Water, public statements must also stay consistent with securities disclosures. For a municipal utility, they must align with what the city council and state regulators are told. A single owner for external statements prevents those channels from drifting apart.
How to make them whole
American Water’s commitment that customers would not pay late fees addressed the most immediate worry. Public services have many equivalents: waiving penalties, extending application windows, pausing collections and shutoffs, and accepting late filings.
These measures often need authority held by elected officials, boards or regulators. Seeking it during an incident delays the reassurance that cuts call volumes. Pre-authorizing a standard menu of relief, with conditions for when each applies and how long it lasts, lets an organization announce relief on the first day. For regulated utilities, that may mean agreeing the approach with the public utility commission in advance.
Relief should also reach the customers a generic notice misses. Households on medical-need registers, customers enrolled in hardship programs and those on automatic payment plans each face a different problem when billing stops and restarts. Automatic payments may fail or double when systems return. Flagging these groups in advance, with a direct contact plan for each, prevents the cases most likely to end in complaints to regulators or local officials.
How to bring them back
Restoration has its own customer experience. When billing resumes, customers may receive several bills at once. When portals return, users may need to reset passwords, and attackers often send phishing messages that imitate those resets. If personal data was taken, notification letters follow, sometimes months later, prompting a second wave of concern.
Planning for this phase means deciding how to spread catch-up bills, offering payment plans, telling customers exactly what a legitimate reset message will look like, and preparing call centers for notification letters. It also means a plain-language account of what happened and what changed. Restoration is a communication event as much as a technical milestone.
With hindsight
American Water’s portal and billing were back within about a week, and the company reported no impact on water service. The episode joined other 2024 water sector incidents that kept federal attention on utility cybersecurity, including the September 2024 attack that pushed the Arkansas City, Kansas, water plant to manual operation. That attention did not produce comprehensive federal cybersecurity requirements for water systems in 2025, so state rules and voluntary programs remained the main levers. The customer-facing arc described here repeated through 2025 and 2026 in ransomware incidents at cities, counties and school districts: portals offline, payments and permits disrupted, relief announced, then notification letters months later. The design choice that most narrows that arc is still the first one discussed here: payment and information services that can keep running apart from the network under attack.