This file records an absence. Working the 2025 water sector, this desk found the Southern Water cost disclosure at 25-0216 and, in the United States, no named community water system incident it could date to 2025 and file.
What the searches returned instead were incidents from adjacent years: a North Dakota treatment plant whose SCADA server was ransomed, and a coordinated attack on more than thirty Minnesota systems — both 2026. Neither was filed here.
An Absence Is Not Evidence Of Nothing Happening
The corpus set out at 25-0502 the routes by which an incident enters the public record: a disclosure obligation, collective redress, a research industry with reason to publish, publication in English, a securities listing.
An American community water system is typically a municipal utility. It is not listed, it is rarely large enough to attract research coverage, and it has no sector-specific federal obligation to disclose a cyber incident.
The Obligation Was Proposed And Withdrawn
The intervening associations argued in part that the survey route would create new exposure, because sanitary survey findings carry public notification requirements, and that state regulators lacked the expertise to conduct the reviews. Those are serious objections. The outcome was still that the obligation went away and nothing replaced it.
This Is The Funding Theme, Stated As Plainly As It Gets
The corpus argues throughout that the parties who could fix the problem are not the parties who pay for it. A small municipal utility has the operational exposure of critical infrastructure and the budget of a town department.
It also has, on the evidence of this search, no mechanism that would put an incident into the record where a database like this one could find it. The two facts are related, and the second one is why this file is graded low.
What The Grade Means Here
It is graded low because the central observation — that this desk found no filable 2025 American water incident — is a statement about a set of searches, not about the world. A better-resourced search would very likely find something.
Recording the gap anyway is the standard set at 25-1114: omitting a thinly-sourced sector reproduces exactly the coverage bias this corpus documents. A file that says "we could not find it, and here is why the record might not contain it" is more honest than a silence that implies nothing happened.
It records what this desk searched for and did not find, and the structural reasons the record may be thin, rather than reporting an incident. The North Dakota and Minnesota incidents referenced are 2026 and are named here only to explain why they were rejected for a 2025 file. The regulatory chronology is drawn from contemporaneous reporting and legal commentary, listed below; this desk has not reviewed the court record. Graded low. Corrections: corrections@forensicpost.com.
- EPA withdraws cybersecurity survey requirement for water systemsWaterWorld
- EPA rescinds rule to include cybersecurity in water system audits after legal challengeCybersecurity Dive
- EPA withdraws cybersecurity rule for public water systemsRegulatory Oversight
- Water treatment plant in North Dakota suffered ransomware attackStateScoop
- Cybersecurity of the municipal water sectorCongressional Research Service