Key Takeaways
- The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and reports of Iranian intrusions have highlighted a growing cyber threat to municipal drinking‑water and wastewater systems nationwide.
- New York State is allocating $9 million through the Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements (SECURE) grant program to 153 local‑government projects, with a focus on bolstering cyber defenses for water utilities.
- Grant funding in the Hudson Valley totals roughly $560 k and supports assessments, upgrades, and training for systems ranging from small village supplies to larger municipal plants.
- The SECURE program mandates cybersecurity training for certified operators, incident‑reporting requirements, and new standards to protect critical operations and sensitive data.
- By combining financial aid with no‑cost technical assistance from the Environmental Facilities Corporation, New York aims to close the gap between expanding digital‑control technologies and the cybersecurity safeguards needed to keep water safe and reliable.
Introduction
Recent warnings from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) have made clear that hackers are increasingly targeting water entities of all sizes across the United States. Simultaneously, open‑source reports indicate that Iranian actors have breached municipal water systems in seven states, underscoring the seriousness and geographic spread of the threat. In response, New York State Governor Kathy Hochul announced a new round of funding designed to help local governments strengthen the cybersecurity posture of their drinking‑water and wastewater infrastructures. The initiative reflects a growing recognition that essential services must be protected against sophisticated, evolving cyber adversaries.
Background on Cyber Threats to Water Systems
The first public indication of these drinking‑water system cyberattacks emerged from Minnesota, where authorities disclosed that hackers had probed roughly 30 water facilities. According to a memo from the Minnesota Bureau of Criminal Apprehension obtained by CNN, the “likely desired impact” of the intrusions was to induce loss of system pressure, which could lead to potential contamination of the water supply. The attackers focused on internet‑connected devices such as pressure monitors, chemical‑dosing controllers, and other supervisory control and data acquisition (SCADA) components. This pattern illustrates how the digitization of water‑utility operations creates new attack surfaces that malicious actors can exploit to disrupt service or compromise public health.
State Response and the SECURE Grant Program
To counter these risks, New York launched the Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements (SECURE) grant program, earmarking $9 million for 153 local‑government projects statewide. Governor Hochul emphasized that the funding will give communities the tools they need to bolster defenses, safeguard essential services, and continue delivering safe, reliable water to residents. The program is part of a broader strategy to address the escalating cyber threat landscape identified by federal agencies and to ensure that water utilities can adapt to increasingly sophisticated attacks.
Implementation Support and Standards
Beyond direct financial awards, the SECURE initiative provides no‑cost technical assistance from the Environmental Facilities Corporation (EFC). This support helps municipalities implement new state‑mandated cybersecurity standards, which include compulsory training for certified operators, formal incident‑reporting procedures, and heightened protections for critical operations and sensitive information. By coupling grant money with expert guidance, New York aims to create a uniform baseline of cyber resilience across its diverse water‑utility landscape, from small rural districts to large metropolitan systems.
Hudson Valley Allocation Overview
Within the Hudson Valley region, several municipalities have been earmarked to receive SECURE funding. The awards vary in size but collectively amount to approximately $560 k, targeting both drinking‑water and wastewater facilities. The funding is intended to support a mix of comprehensive assessments, targeted upgrades, and planning efforts that will enable each utility to identify vulnerabilities and prioritize remedial actions. The following list details the specific grant amounts and their designated uses.
Specific Grant Awards and Their Purposes
- Hyde Park Regional Water System and Central Dutchess Water System each receive $32,300 to conduct cybersecurity assessments and begin implementing recommended safeguards.
- East Fishkill, Town of East Fishkill 2026 Cyber Security Program is awarded $34,075 for a multi‑year initiative aimed at strengthening the town’s overall cyber defenses.
- Kingston receives $80,000 for its drinking‑water system and an additional $79,360 for its wastewater treatment plant, enabling parallel upgrades to both critical infrastructures.
- The Village of Mount Kisco is granted $50,000 to assess cybersecurity needs and prioritize upgrades across its water infrastructure.
- The Town of New Windsor receives $50,000 to evaluate its drinking‑water system’s cyber readiness.
- The City of Newburgh is allocated $50,000 to assess cybersecurity requirements for its wastewater treatment plant.
- The Village of Red Hook and the Village of Sleepy Hollow each obtain $50,000 for drinking‑water security assessments.
- A wastewater district in the Town of Tuxedo receives $15,000 for a focused cybersecurity evaluation.
- The City of Peekskill is awarded $50,000 to assess its water resource recovery facility’s cyber posture.
- The City of Yonkers receives $15,000 for a drinking‑water cybersecurity assessment.
- Finally, the Town of Yorktown Heights obtains $36,400 to conduct a wastewater‑system cybersecurity assessment.
These targeted investments allow each utility to first understand its current risk profile and then allocate resources toward the most pressing deficiencies, whether they involve network segmentation, multi‑factor authentication, intrusion‑detection systems, or staff training.
Impact and Future Outlook
By funding assessments and subsequent upgrades, New York’s SECURE program seeks to close the gap between the rapid adoption of digital‑control technologies in water utilities and the often‑lagging implementation of robust cybersecurity measures. The mandated operator training ensures that personnel on the front lines can recognize phishing attempts, anomalous system behavior, and proper reporting channels. Incident‑reporting requirements create a clearer picture of emerging threats across the state, enabling faster collective responses. Over time, these measures should reduce the likelihood of successful intrusions that could disrupt water pressure, contaminate supplies, or disable treatment processes—outcomes that have direct implications for public health and community trust.
Conclusion
The convergence of federal warnings, documented foreign cyber intrusions, and the increasing reliance on internet‑connected infrastructure has made cybersecurity a critical priority for the nation’s water sector. New York’s SECURE grant program represents a proactive, state‑level response that combines financial assistance, technical expertise, and regulatory standards to fortify drinking‑water and wastewater systems against evolving threats. The targeted allocations in the Hudson Valley illustrate a tailored approach: utilities receive the resources needed to assess their unique vulnerabilities and implement appropriate defenses. As cyber threats continue to grow in sophistication, initiatives like SECURE will be essential in ensuring that essential water services remain safe, reliable, and resilient for all New Yorkers.