American Water Faces Suit Over Breach That Leaked Millions’ Data

American Water Works Company Inc. exposed the sensitive personal information of millions of customers across the US when its systems were hacked earlier this month, a proposed class action alleges.

The water utility company failed to implement industry standards to protect its customers’ data, including encrypting or redacting sensitive information, leading to a breach of its systems discovered on Oct. 3, according to a complaint filed Monday in the US District Court for the District of New Jersey.

American Water made several public promises about its security measures, according to the complaint, including that it’s “constantly testing” its cyber response protocol and that it has worked with “local, state, and federal government agencies to prepare for cyber threats.”

The cyber incident exposed sensitive personally identifiable information that could be used to identify, contact, or locate a person, the complaint said, including names, addresses, phone numbers, dates of birth, Social Security numbers, driver’s license information, and financial information.

The New Jersey-based water and wastewater utility company serves more than 14 million people across 14 states, according to its website.

American Water first identified an unauthorized cybercriminal got access to its computer networks and systems on Oct. 3, according to an Oct. 7 report to the US Securities and Exchange Commission. The utility said it immediately activated its incident response protocols and notified law enforcement.

None of its water or wastewater facilities or operations were “negatively impacted” by the cyber incident, it said. Also on Oct. 7, American Water publicly disclosed the breach on its website, warning customers that it deactivated certain systems “in an effort to protect our customers’ data.”

The SEC Filing and website notice didn’t specify the root of the breach, the vulnerabilities exploited, or the measures taken afterward to prevent future incidents, according to the complaint.

In a press release Tuesday, the water utility said it is “in the process” of reactivating the systems that were taken offline due to the cyber incident after its security teams confirmed they were secure. The investigation into the nature and the scope of the incident is “ongoing,” American Water said.

Named plaintiff Barbara Menichini, a Pennsylvania resident and American Water customer, accused the utility of negligence, breach of implied contract, and unjust enrichment. Her complaint seeks compensatory and punitive damages as well as reimbursement of litigation costs.

Representatives for American Water didn’t immediately respond to a request for comment.

Ahdoot & Wolfson PC represents Menichini and the proposed class.

The case is Menichini v. American Water Works Co., D.N.J., No. 1:24-cv-09776, complaint filed 10/14/24.