New York State is distributing more than $9 million in grants to help 153 drinking water and wastewater systems shore up their cybersecurity defenses. Governor Kathy Hochul announced the funding through the state’s Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements (SECURE) grant program.
The grants will pay for cybersecurity assessments and the implementation of security improvements at local utilities. Recipients also gain access to no-cost technical assistance from the New York State Environmental Facilities Corporation. Under the SECURE program, utilities can receive up to $50,000 for assessments and up to $100,000 to implement upgrades.
The funding is designed to help utilities meet minimum cybersecurity standards New York introduced in March. Those standards require mandatory cybersecurity training for certified operators, incident reporting obligations, risk-based protections for critical operations and sensitive information, and the designation of a cybersecurity lead at larger drinking water systems.
Timing tied to recent attacks
The announcement follows a coordinated campaign that targeted operational technology at water and wastewater facilities across the United States. More than 30 community water systems in Minnesota were hit on July 26 and 27, with some municipalities reporting disruptions to automated control functions. The city of Braham briefly took its water plant offline after attackers shut down operating controls affecting the well and treatment plant, though most facilities kept operating using contingency procedures.
The campaign was later found to have reached water infrastructure in at least seven states. Michigan confirmed malicious activity affecting a small number of communities, Rapid City, South Dakota reported an incident at a wastewater lift station, and Georgia was reportedly also targeted. No New York utility has been publicly linked to the campaign, and federal investigators have not formally attributed the attacks, though Iran has emerged as a leading suspect given similarities to prior campaigns linked to Iranian threat actors known to target industrial control systems and water utilities.
In response, CISA urged water and wastewater operators to remove publicly exposed programmable logic controllers and other OT from the internet, change default passwords, route remote access through secure gateways or VPNs, and restrict connections to trusted IP addresses.
Part of a larger investment
Hochul said the recent attacks against water systems in multiple states underscore that the threat is real and escalating. The $9 million cybersecurity grant is separate from a five-year, $3.8 billion clean water infrastructure investment in New York’s fiscal year 2027 budget, which the state says will bring its total water infrastructure grants since 2017 to more than $10 billion.