American Water Works Company, Inc.

American Water pulled its MyWater portal and paused billing to wall off unauthorized activity inside its corporate networks, then reassured 14 million customers that the water itself was never touched. That reassurance is the tell: the intrusion lived in the customer-facing IT stack, while the operational technology that treats the water sat behind a trust boundary that actually held. Months on, the largest water utility in the country had named neither the actor nor the vector, certain of what stayed safe and silent on what got in.