Discovery of and Response to Cybersecurity Incident
On October 3, 2024, American Water Works Company, Inc. (the “Company”) learned of unauthorized activity within its computer networks and systems, which the Company determined to be the result of a cybersecurity incident. Upon learning of this activity, the Company immediately activated its incident response protocols and third-party cybersecurity experts to assist with containment and mitigation activities and to investigate the nature and scope of the incident. The Company also promptly notified law enforcement and is coordinating fully with them. The Company has taken and will continue to take steps to protect its systems and data, including disconnecting or deactivating certain of its systems. The Company currently believes that none of its water or wastewater facilities or operations have been negatively impacted by this incident. Although the Company is currently unable to predict the full impact of this incident, the Company does not expect the incident will have a material effect on the Company, or its financial condition or results of operations.
Cautionary Statement Concerning Forward-Looking Statements
Certain statements included in this Current Report on Form 8-K are forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, Section 21E of the Securities Exchange Act of 1934, and the Private Securities Litigation Reform Act of 1995. In some cases, these forward-looking statements can be identified by words with prospective meanings such as “intend,” “plan,” “estimate,” “believe,” “anticipate,” “expect,” “predict,” “project,” “propose,” “assume,” “forecast,” “outlook,” “future,” “pending,” “goal,” “objective,” “potential,” “continue,” “seek to,” “may,” “can,” “will,” “should” and “could,” or the negative of such terms or other variations or similar expressions, including statements regarding the Company’s plans to protect its systems and the impact of the incident on the Company or its financial condition or results of operations. These forward-looking statements are predictions based on the Company’s current expectations and assumptions regarding future events. They are not guarantees or assurances of any outcomes, performance or achievements, and readers are cautioned not to place undue reliance upon them. The forward-looking statements are subject to a number of estimates and assumptions, and known and unknown risks, uncertainties and other factors. Actual results may differ materially from those discussed in the forward-looking statements included in this Current Report on Form 8-K as a result of the factors discussed in the Company’s Annual Report on Form 10-K for the year ended December 31, 2023, as filed with the Securities and Exchange Commission (the “SEC”) on February 14, 2024, and other filings with the SEC, and additional risks and uncertainties, including with respect to (1) the extent of the cybersecurity incident and the results or findings of the Company’s investigation thereof; (2) the Company’s ability to contain and/or mitigate the incident; (3) the nature and scope of unauthorized activity or access or use of any sensitive, proprietary or confidential financial, or personal data or information, which may result in negative consequences such as fines, penalties or loss of reputation; (4) incremental expenses, damages or losses associated with this incident or the Company’s containment, mitigation and investigation thereof; (5) the nature, scope and result of any claims or litigation, or regulatory, legislative, local or municipal actions or proceedings that may be brought against the Company or its affiliates, or other affected parties, as a result of the incident; (6) the availability and amount of insurance coverage related to this incident; (7) other legal, reputational and financial risks or impacts resulting from this or other cybersecurity incidents and the potential impacts on the Company’s financial condition or results of operations; (8) the length and scope of disruption to the Company’s business operations caused by the incident; and (9) other economic, financial, political, business and other factors that may impact or affect the water and wastewater industries generally or the Company specifically.
These forward-looking statements are qualified by, and should be read together with, the risks and uncertainties set forth above and the risk factors included in the Company’s annual and quarterly reports as filed with the SEC, and readers should refer to such risks, uncertainties and risk factors in evaluating such forward-looking statements. Any forward-looking statements speak only as of the date of this Current Report on Form 8-K. The Company does not have any obligation or intention to update or revise any forward-looking statement, whether as a result of new information, future events, changed circumstances or otherwise, except as otherwise required by the federal securities laws. New factors emerge from time to time, and it is not possible for the Company to predict all such factors. Furthermore, it may not be possible to assess the impact of any such factor on the Company’s business, or the extent to which any factor, or combination of factors, may cause results to differ materially from those contained in any forward-looking statement.
2