Ransomware Attacks Target Water Utilities in U.S. and U.K., Exposing Sensitive Data Veolia North America’s Municipal Water division recently suffered a ransomware attack, disrupting internal back-end systems and causing temporary delays in online bill payment services. The company swiftly isolated affected servers, restoring functionality while confirming that water and wastewater treatment operations remained unaffected. A limited number of individuals may have had personal data exposed, and Veolia is notifying impacted parties while working with law enforcement and third-party forensic experts to investigate the incident and strengthen defenses. Meanwhile, Southern Water in the U.K. disclosed that cybercriminals claimed to have stolen data from its IT systems, though customer services and financial systems remain operational. The company, which detected suspicious activity earlier, is collaborating with cybersecurity specialists and regulators, including the National Cyber Security Centre (NCSC). If customer or employee data is confirmed compromised, Southern Water will notify affected individuals. The Black Basta ransomware group has taken credit for the attacks, leaking samples of stolen data including passport scans, HR documents with personal details, and corporate records. These incidents follow a broader trend of cyber threats targeting critical infrastructure, particularly in the water sector, where resource constraints and interconnected supply chains create vulnerabilities. Experts note that while neither Veolia nor Southern Water reported disruptions to industrial control systems (ICS) or operational technology (OT), the attacks underscore the need for robust corporate cybersecurity. The U.S. Cybersecurity and Infrastructure Security Agency (CISA), FBI, and EPA have issued guidance for water utilities to bolster defenses, emphasizing that even non-critical systems can serve as entry points for broader intrusions. The incidents reflect a growing focus on high-risk sectors, where sensitive data and essential services make them prime targets for ransomware groups.