American Water faces nine class actions after major data breach impacting millions

American Water Works Co., the largest regulated water and wastewater utility in the United States, is facing nine class action lawsuits following a significant data breach that potentially compromised the personal information of customers across 14 states. While the exact number of impacted individuals remains unknown, the utility company serves over 14 million people, leaving a substantial portion of its customer base at risk.

 

The lawsuits, filed by prominent law firms across the country, stem from a cybersecurity incident disclosed by American Water in a U.S. Securities and Exchange Commission filing on October 3, with further details shared in an October 7 online notice. The company has since taken measures, including temporarily shutting down its billing and payment portal to safeguard against further exposure.

 

However, the lawsuits, filed as early as October 11, allege that American Water’s actions were insufficient and have left customers vulnerable to identity theft and financial fraud. The most recent suit was filed on October 22. The filings argue that American Water neglected essential data protection measures, including failing to encrypt or redact sensitive personal identifiable information (PII) within its systems. According to one complaint, Karwoski v. American Water Works, the breach enabled hackers to access unencrypted PII, with plaintiffs asserting that "the present and continuing risk to victims of the data breach will remain for their respective lifetimes."

 

Another lawsuit, Menichini v. American Water Works, claims the utility failed in its duty to establish a secure data environment and neglected to perform essential audits, vendor assessments, and monitoring to protect against breaches. The suit asserts that American Water inadequately vetted its vendors and failed to maintain a data security system capable of resisting cyberattacks.

 

While the identity of those behind the cyberattack is still unknown, recent incidents targeting other water utilities have been linked to Russian, Chinese, and Iranian-backed actors, according to cybersecurity experts. The alleged breach at American Water raises broader security concerns, as utility companies have become frequent targets of cyberattacks.