Clayton County Water Authority is investigating whether unauthorized cyber activity caused or contributed to a July 27 pump station disruption in Clayton County, Georgia, that left some customers with low pressure or no water.
The authority provides water, wastewater and stormwater services to more than 300,000 residents and businesses in the county and surrounding areas. The disruption affected Forest Park, Lake City, Morrow and Riverdale in northern Clayton County.
The authority said a pump station failed at about 1 a.m. July 27 and water pressure was restored around 4 a.m. A precautionary boil-water advisory covering the four cities was lifted the next day after samples from the affected area tested negative for harmful bacteria.
In an Aug. 3 notice, the authority said unauthorized cyber activity may have caused or contributed to disruptions involving some operational systems and water service. It said it activated incident-response procedures and coordinated with the FBI, the Cybersecurity and Infrastructure Security Agency, state regulators, law enforcement and cybersecurity partners.
The authority has not identified the type of cyber activity under investigation or explained how its operational systems were affected. It has not identified who may be responsible or said whether any systems were encrypted or a ransom was demanded.
The authority said it found no evidence that customer billing or payment information was accessed.
In an interview with WSB-TV, authority communications director Erin Thomas said some pump stations went down, although the authority’s initial notice referred to a single pump station failure.
The station reported that the inquiry focused on programmable logic controllers, devices used in water systems to control pumps and treatment processes. Thomas said investigators were trying to determine whether any breach involved an internal or external connection.
Thomas also told the station that investigators were examining whether the disruption was part of a broader cyber campaign targeting water infrastructure.
Chip in once
If this reporting helped you, a one-time tip helps cover hosting, tools and future investigations.
Support us monthly
A small monthly pledge keeps independent coverage and our reader tools online for everyone.
A July 30 FBI and Environmental Protection Agency alert said water and wastewater utilities in at least seven states had reported incidents since July 27 involving internet-facing programmable logic controllers. Some caused pressure loss and flooding.
The alert did not name any affected utilities, which is common in federal cyber advisories. No connection to Clayton County has been confirmed.
Minnesota officials separately said a coordinated cyberattack targeted operational technology at more than 30 community water systems on July 26 and 27. Rapid City, South Dakota, reported a cyber incident involving a wastewater lift station.
Authorities have not publicly linked those incidents to Clayton County. If investigators confirm Clayton County was part of the broader activity, its outage would be among the clearest public examples of customers losing water pressure or service.
Water service has been restored and the boil-water advisory remains lifted, but the investigation is ongoing. The authority said it would not release technical details that could compromise system security or law enforcement efforts.
