Cyberattack interrupts American Water billing and customer portal

Analyst assessment

American Water identified unauthorized activity in its networks on Oct. 3, 2024, and determined that it was a cybersecurity incident, according to its Oct. 7 regulatory disclosure. The company disconnected some systems while outside specialists and law enforcement assisted its response. Oct. 3 is the discovery date; the initial intrusion time remains unknown.

The documented operational consequences affected customer information systems, billing and customer assistance. The company said its water and wastewater facilities were unaffected and that water quality was unchanged. Those statements distinguish the customer-system interruption from a disruption of physical water service.

Operational significance

The MyWater customer portal was unavailable and billing was paused. The Record’s Oct. 7 report also described appointment rescheduling and a call-center interruption. WCBU’s contemporaneous report quoted the company’s description of limited call-center functionality. A company notice reproduced in the initial coverage supplied alternate payment and emergency telephone channels, so the evidence does not establish failure of every payment method or emergency contact.

Spectrum News’ Oct. 8 report specifically identified Missouri American Water and Illinois American Water customers being notified about the incident and described paused billing and limited call-center service. This supports effects through the shared customer platform, rather than separate intrusions into each subsidiary.

On Oct. 10, the company’s restoration announcement said MyWater was operational and standard billing was resuming. It described the broader reconnection and reactivation of affected systems as still in progress, after security checks. The company waived late charges for the platform interruption. This establishes recovery milestones while leaving the completion date for all affected systems unknown.

Confidence and uncertainty

Confidence is high in the acknowledged intrusion, system isolation and customer-service disruption. The 2024 annual report subsequently confirmed that containment, mitigation and restoration were complete and reported no material effect on the company or its financial condition or results. This supports a resolved status without supplying an exact incident end date.

In a later company FAQ, American Water said customer personal information covered by breach-notification laws in its 14 regulated states was not impacted. It said any affected customers outside that footprint would be notified under applicable law. This narrow company finding does not establish that every category of information was unaffected or that no information was accessed. The finding appears in a July 2025 copy of the FAQ; its original announcement date is unknown.

The company’s first-quarter 2025 filing reported that the consolidated cyber-related class action was voluntarily dismissed without prejudice, with a court order entered March 24, 2025. That outcome does not establish whether customer information was accessed or stolen. No named attacker, encryption, ransom demand or payment has been independently established.

Analytic gaps

In a Sept. 16, 2025, letter, Illinois’ attorney general’s office asked Illinois American Water about the October cyber incident and possible effects on billing, customer information and meter data during an inquiry into Homer Glen billing concerns. The letter requests findings; it does not demonstrate that the cyber incident caused those billing problems, compromised meter data or continued disrupting operations in 2025.

The latest direct evidence of ongoing system reactivation is dated Oct. 10, 2024. Beyond the company’s finding about regulated-state customer personal information, the scope of any other data access remains unresolved. The full effects at individual subsidiaries, communities or military installations are not established. The company’s multistate footprint does not establish identical effects at every operation, and appointment rescheduling should not be treated as proof that every local service appointment was affected.