Free tools Windows power users keep installed
One-click scans. No signup required.
A water utility cyberattack does not by itself mean tap water is contaminated, treatment has stopped, or customer data was stolen. The utility must assess operational and data impacts, while customers should rely on verified utility and public-health notices—not rumors or unsolicited messages.
If you’re a water customer, check official notices first
Check your water utility’s official website, phone line, and text-alert system, along with announcements from local public health and emergency management agencies. A cyber incident’s effect depends on which systems were affected; only the utility and relevant authorities can establish conditions for a particular community.
As an Amazon Associate I earn from qualifying purchases.
If officials issue a boil-water, do-not-drink, or other advisory, follow it exactly. Check the same official channels for updates and confirmation before treating an advisory as ended. The U.S. Environmental Protection Agency (EPA) directs utilities to assess effects on treatment and service and to notify the public when required; an incident alone does not establish whether an advisory is needed. EPA’s cybersecurity incident action checklist describes those response steps.
Recommended Free Tools
If the incident involves billing or customer information
Use only verified utility channels to get account-protection instructions. Do not click links or call numbers in an unexpected message claiming to be about the breach; locate the utility’s contact information independently. EPA’s checklist tells utilities to assess whether employee or customer personally identifiable information was compromised and to notify affected people if it was.
#1 Best Overall
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
For utility staff: respond in a controlled sequence
Use the utility’s incident response and emergency response plans. The steps below reflect EPA’s September 2024 checklist and federal incident-response guidance; they are orientation, not a substitute for the utility’s procedures, qualified responders, or incident-specific legal advice.
1. Activate incident response and establish coordination
Contact the designated incident lead, management, IT and operational technology (OT) staff, service providers, and system integrators using prevalidated contact information. Bring in relevant public safety, public health, and regulatory partners. Assess whether business systems or essential functions—such as treatment, distribution, wastewater conveyance, alarms, pumps, communications, or remote control—may be affected. EPA provides a customizable incident action checklist for water systems.
2. Contain affected computers without destroying evidence
Where feasible, disconnect compromised computers from the network to limit spread, but do not turn them off or reboot them. EPA says: “Do not turn off or reboot systems – this preserves evidence and allows for an assessment to be performed.” Coordinate any action affecting OT with the staff responsible for safe process control; untrained staff should not improvise technical remediation.
3. Assess physical operations and public-health effects
Determine whether equipment, service, treatment, distribution, wastewater conveyance, alarms, pumps, or remote-control functions are affected. Operators must decide whether processes can continue safely. If control systems are compromised, trained staff may use established manual operating procedures where the utility’s plan supports it. Work with utility leadership, regulators, and public-health officials to decide whether customers need an advisory.
Rank #2
- WatchGuard Firebox T45 tabletop appliances bring enterprise-level network security to small office/branch office and retail environments. These appliances are small-footprint, cost-effective security powerhouses that deliver all the features present in WatchGuard’s higher-end UTM appliances, including all security capabilities, such as AI-powered anti-malware, threat correlation, and DNS-filtering.
- 5G and Wi-Fi 6 enabled models available. Up to 3.94 Gbps firewall throughput, 5 x 1Gb ports, 30 Branch Office VPNs
- Zero-touch deployment makes it possible to eliminate much of the labor involved in setting up a Firebox to connect to your network - all without having to leave your office. A robust, Cloud-based deployment and configuration tool comes standard with WatchGuard Firebox appliances. Local staff connects the device to power and the Internet, and the appliance connects to the Cloud for all its configuration settings.
- Firebox T45 models make network optimization easy. With integrated SD-WAN and optional 5G technology, you can ensure failover to the cellular network, minimize disruptive connectivity, and establish secure and reliable connections for small offices.
- Standard Support includes 24x7 access to technical support, with an unlimited number of incidents with a targeted response time of 24 hours for low priority, 8 hours for medium priority, 4 hours for high priority, and live calls for critical priority. Support is Web-Based and Phone-Based.
4. Preserve evidence and establish the incident’s scope
Have qualified security staff review system and network logs and identify affected equipment, accounts, and networks. Document logged-on accounts, running processes, remote connections, and open ports. If feasible, create forensic images; identify malware and external systems involved; and check whether backups may also be compromised. Do not modify or delete data that could relate to the incident. Record suspicious calls, emails, or messages, observed damage, and response actions with dates and times.
5. Report, notify, and recover
Use current official reporting channels and the utility’s incident plan. EPA identifies regulatory agencies and law enforcement—including the FBI field office or FBI Internet Crime Complaint Center (IC3)—and says the Cybersecurity and Infrastructure Security Agency (CISA) can assist with IT/OT response and recovery. EPA’s older state brief also names the primary oversight agency, typically the state, and WaterISAC. The joint federal guide notes that reporting requirements evolve and its reporting avenues are illustrative rather than exhaustive; consult legal counsel about duties that apply to the incident and jurisdiction. The CISA, EPA, and FBI incident response guide provides additional context.
Coordinate malware removal and restoration with qualified IT/OT responders, vendors, integrators, and government partners. Confirm backups are clean before using them to restore systems. Submit required reports, notify affected employees or customers if personal information was compromised, and review the incident afterward to update vulnerability assessments and response plans.
What the response depends on
There is no single technical fix for every water-sector incident. The appropriate actions depend on which systems were affected and what the utility can safely operate. Key distinctions include:
Rank #3
- Integration with Unifi Controller. Powerful firewall performance
- Convenient VLAN support. QoS for enterprise VoIP
- VPN server for secure communications. 10/100/1000Base-T
- 3 Ports - Management Port - SlotsGigabit Ethernet - Wall Mountable, Desktop
- Refer instruction manual for troubleshooting steps.
- Business IT versus process-control OT: A compromised billing system raises different immediate operational questions from a compromised treatment or control system.
- Containment versus evidence: Isolating a computer may limit spread, but responders should preserve evidence and coordinate changes that could affect operations.
- Automated versus manual operation: Manual operation is an option only when trained staff can carry it out safely under established procedures.
- Confirmed impact versus assumption: Water-safety notices and customer-data notifications should be based on assessment and official direction, not inferred from the word “hack.”
- Recovery readiness: Restoration depends on verified-clean backups and coordinated remediation, not simply restarting affected systems.
Preparedness that helps reduce disruption
For prevention and resilience—not as a substitute for incident response—CISA, EPA, and the FBI’s February 21, 2024 fact sheet recommends reducing exposure to the public internet, conducting cybersecurity assessments, changing default passwords, inventorying IT and OT assets, exercising response and recovery plans, backing up systems, reducing vulnerability exposure, and training staff. Read the joint fact sheet.
EPA’s checklist adds measures such as applying current patches and anti-malware, testing backups, using multifactor authentication where possible, restricting privileges and remote access, limiting internet access to control systems, separating process-control and business traffic where feasible, and training staff to operate critical processes manually.
Emergency planning requirements and resources
For U.S. community drinking-water systems serving populations greater than 3,300, EPA says Safe Drinking Water Act section 1433(b) requires an emergency response plan (ERP) that incorporates findings from the system’s risk and resilience assessment. EPA states its drinking-water ERP materials were updated in September 2024; its wastewater ERP materials were updated in October 2025. The agency distinguishes the drinking-water requirement from its wastewater planning recommendations. Check EPA’s water-sector cybersecurity resources for the relevant planning materials.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
