Recent cyberattacks on municipal water systems in New Jersey have prompted a new bipartisan push in Congress aimed at protecting water, electric and other critical infrastructure from increasingly sophisticated digital threats.
U.S. Rep. Josh Gottheimer of New Jersey announced a Critical Infrastructure Security Plan on Wednesday, August 12, following attacks that affected two municipal water systems in Cape May County and similar incidents reported across multiple states. (Josh Gottheimer)
The plan includes two new bipartisan bills designed to give smaller utilities access to stronger cybersecurity tools and faster federal assistance when an attack occurs.
New Jersey Water Systems Forced to Operate Manually
According to Gottheimer’s office, hackers recently targeted municipal water systems in the City of Cape May and the Borough of Woodbine.
The attacks interfered with operators’ ability to monitor and control equipment digitally, forcing workers to go into the field and manually operate valves and pumps.
Despite the intrusion, water service was not interrupted, and local officials worked with state and federal cybersecurity teams to secure the systems.
The incidents were part of a broader series of attacks affecting water systems in New Jersey and other states. Federal authorities, including the FBI, CISA and EPA, have been investigating the campaign and urging water utilities to strengthen their security.
AI Cyber Defense Act
The first proposed measure is the AI Cyber Defense Act.
The bipartisan legislation would give critical infrastructure operators access to advanced AI-based cybersecurity tools that smaller municipal utilities might otherwise be unable to afford.
The goal is to help water and electric systems identify vulnerabilities before hackers can exploit them.
Gottheimer is introducing the proposal with Representatives Don Bacon of Nebraska, Zach Nunn of Iowa, Hilary Scholten of Michigan and Greg Landsman of Ohio.
For small towns with limited IT departments and no full-time cybersecurity teams, access to these tools could provide a level of protection currently available mainly to larger organizations.
A Rapid-Response Service for Smaller Utilities
The second proposal, the Securing Our Critical Infrastructure Act, would establish a dedicated cybersecurity rapid-response and threat-notification service within the Cybersecurity and Infrastructure Security Agency, or CISA.
The service would focus specifically on small and medium-sized water and electric utilities.
Instead of a local utility trying to determine which federal agency to contact during an attack, the proposal would create a single point of contact capable of providing warnings and technical assistance. (Josh Gottheimer)
Why Smaller Systems Are Particularly Vulnerable
Many municipal water systems were built decades ago, long before cybersecurity became a major concern.
According to Gottheimer’s office, approximately 97 percent of the roughly 150,000 public water systems in the United States serve small communities, where cybersecurity staff and resources can be limited.
New Jersey alone has more than 600 community water systems, supplying drinking water to approximately 87 percent of the state’s population.
Older software, internet-connected controllers and limited cybersecurity budgets can leave those systems particularly vulnerable.
Federal Agencies Asked to Increase Assistance
In addition to the two bills, Gottheimer said he is sending a letter to CISA, the EPA and the FBI asking the agencies to provide additional incident-response teams and technical assistance to water and wastewater systems affected by the recent attacks.
The request also calls for longer-term cybersecurity guidance and a permanent rapid-response framework for water and electric utilities. (Josh Gottheimer)
Proposals, Not Yet Law
The measures announced this week are proposed federal legislation and have not yet become law.
However, the attacks in Cape May County have brought an issue that can often seem distant directly into New Jersey communities: cybersecurity is no longer only about protecting computers or personal information.
An attack on critical infrastructure can potentially affect something far more basic — whether residents can turn on a faucet, whether pumps continue running and whether essential public services remain under local control.
For New Jersey’s hundreds of community water systems, the recent incidents may serve as a warning that protecting drinking water increasingly means protecting the computer systems behind it as well.
Source: Office of U.S. Rep. Josh Gottheimer, August 12, 2026.
Additional source: Jay Edwards / WRNJ via X
By NJ RADAR Team