N.J. Water Utility Cyberattacks Prompt Federal Action

Cyberattacks on two municipal water systems in Cape May County have spurred new bipartisan federal legislation to strengthen cybersecurity defenses for small and midsize utilities nationwide.

The City of Cape May Water and Sewer Department and the Borough of Woodbine Water Department were targeted as part of a broader campaign affecting water systems in as many as 12 states last month. Swift action by staff members prevented service disruptions, and authorities confirmed no drinking water was contaminated and no customer data was compromised.

Michael Geraghty, chief information security officer at the New Jersey Cybersecurity and Communications Integration Cell, acknowledged the threat landscape. "Have there been other attacks in New Jersey? Absolutely, and there will be other attacks in New Jersey," He said, noting that while many attacks are blocked, some succeed.

At an announcement in Park Ridge on Wednesday, U.S. Rep. Josh Gottheimer, D-N.J., unveiled two bipartisan bills alongside local officials. One measure would furnish artificial intelligence security tools to water utilities and power stations serving communities with greatest need. A second would establish a rapid-response notification system offering small and midsize municipalities direct contact during cyberattacks.

"This is about fighting the bad guys, fighting our adversaries, fighting China, fighting Russia, fighting Iran, before they get here," Gottheimer said.

Bergen County Prosecutor Mark Musella characterized water utilities as vulnerable targets, with criminals exploiting remote access weaknesses. His office operates cybercrime, counterterrorism and digital forensics units tracking online threats.

Reports have indicated Iran's involvement in the broader campaign. American Water and Veolia, two of New Jersey's largest water utilities, stated they were unaffected.