An old water account can still matter because utilities often retain your name, address, birthdate and Social Security number after closure. Criminals can reuse those permanent identifiers for identity theft years later. A data breach here means unauthorized access to a utility computer network, not contamination of drinking water. The risk persists because the stolen details cannot be changed like a password.
Table of Contents
- What recent water utility breaches exposed
- Why water systems hold high-value identity data
- Why a closed account does not end the risk
- What should you do after a breach notice?
What recent water utility breaches exposed
On Oct. 3, 2024, American Water detected unauthorized activity on its computer network. In an Oct. 7 filing, American Water said it disconnected customer systems including the MyWater portal and paused billing to protect data, according to American Water's October SEC filing. In January 2024, Veolia North America disclosed a ransomware incident in its Municipal Water division that took backend systems offline. The incident disrupted customer billing access across its 550 served communities, according to a Veolia statement reported by TechTarget.
Southern Water confirmed in February 2024 that a January ransomware attack stole personal data for about 470,000 people. The stolen data included names, birthdates, national insurance numbers and bank details, according to TechCrunch's February 2024 report. Veolia's Feb. 27, 2024 notice to Maine's attorney general detailed a smaller affected group. The Jan. 9 incident compromised 8,951 people's names, Social Security numbers, financial or payment-card data, birthdates and driver's license numbers, according to TEISS reporting on the Maine filing.
Why water systems hold high-value identity data
American Water is the largest regulated U.S. water and wastewater utility, operating about 500 systems in 14 states. It serves over 14 million people, so both current and former account holders were in the exposure pool, according to Pew Trusts. U.S.
water systems retain sensitive billing and identity records while facing known security gaps. The EPA reported in May 2024 that over 70% of inspected community systems failed Safe Drinking Water Act cybersecurity checks. Its Oct. 8, 2024 scan found 97 systems serving 26.6 million users with critical or high-risk internet exposures, according to the EPA Office of Inspector General.
Why a closed account does not end the risk
A closed account still matters because stolen Social Security numbers, birthdates and home addresses are permanent identifiers. They cannot be reset like passwords, so identity-theft risk does not diminish over time, according to Security.org's identity-theft research.
A former customer faces much of the same exposure as a current customer. The utility record often keeps the same name, old service address, payment details and identity numbers. Those facts remain useful for new-account fraud, tax fraud and account takeover.
What should you do after a breach notice?
Take a breach letter seriously even if you moved or paid the final bill years ago. Former customers should act on the same timeline as current customers because the exposed identifiers are equally durable. Safe water does not prove safe data.
In an Oct. 10, 2024 update, American Water said the incident did not affect water quality or operations while it reconnected systems methodically. Operational safety is separate from customer-data access, so use the notice and your statements as the guide for protective steps.
- Place a fraud alert or credit freeze with a credit bureau.
- Monitor bank, card and utility statements long-term for unfamiliar activity.
- Keep the breach letter and watch for follow-up notices about offered help.
- File an identity-theft report with the FTC if misuse appears, following FTC guidance reported by CyberGuy.
You Might Also Like
- Data Breach Exposed an Old Address? Why Outdated Information Can Still Be Useful to Scammers
- Southern Water Data Breach: What to Keep From Your Notification Letter
- Southern Water Data Breach: What to Ask if You Never Received a Letter