Credit rating agency warns that cyberattacks could impact water utilities’ ability to pay back debt

Fitch Ratings, one of the “Big Three” credit rating agencies that assesses the creditworthiness of bonds, companies, and governments, published an alert Thursday warning that cyberattacks could pose a “material risk” to water and sewer utilities and potentially impact their ability to repay debt.

The alert follows multiple reports of cybersecurity incidents affecting water utilities. In February, city officials in Oldsmar, Florida, said a hacker attempted to poison the local water supply by changing the concentration of sodium hydroxide at a water treatment plant to toxic levels. The attack was spotted and stopped before anyone in the 15,000-person city was harmed they said. Last week, the U.S. Department of Justice indicted a Kansas man on charges of hacking into a local water utility in March 2019 in an attempt to sabotage operations and harm the local population.

Although Fitch did not say its alert was prompted by particular incidents, it highlighted several ways that cybersecurity incidents could hinder utility operations and impact them financially. These include but are not limited to:

• The cost of emergency efforts to combat cyberattacks, which could reduce cash reserves and increase operating expenses.

• The need for unanticipated debt financing to support new cyber infrastructure.

• The loss or corruption of customer data could lead to the inability to read meters or access billing systems.

• Regulatory action or lawsuits from constituents, which could result in unexpected financial burdens.

Water utilities have raised about $5 billion in debt since 2019, according to S&P Global Market Intelligence. The capital raises are used for long-term infrastructure rollouts and upgrades, and are paid back years later when the utility collects revenue from consumers.

Fitch and other credit rating agencies assess the capacity for utilities to repay their debt—if it’s considered a relatively safe investment, they are given a positive rating, like AAA. More risky debt is given a lower rating, signaling to investors that it is a speculative investment that could potentially go unpaid. This type of so-called high yield debt is generally more expensive for the utility company to pay back.

According to Fitch documents, traditional factors that could impact a utilities’ credit rating includes things like corruption and political delays.

The alert isn’t the first time a credit rating agency has warned of cybersecurity risks: In 2019, Moody’s—another one of the “Big Three” agencies—slashed its rating outlook on Equifax from stable to negative following a data breach at the company. It was the first time cybersecurity was named as a factor in an outlook change, a Moody’s spokesperson told CNBC.