Company: AWK
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001410636-25-000022
Chunk: 131

Company: American Water Works Company, Inc.
Filing Date: 2025-02-19
Form: 10-K
Item: Item 7
Chunk 131
---
 and not the public or customers, accountable for PFAS-related liability.

On October 30, 2024, the EPA published the LCRI with a “Compliance Date” of November 1, 2027. The LCRI focus includes requirements related to (i) replacing all lead and certain galvanized service lines under a utilities control by October 30, 2037, 10 years from the Compliance Date; (ii) identifying the materials of all service lines of unknown material; (iii) improving tap sampling; (iv) lowering the lead action level; and (v) strengthening protections to reduce exposure. The LCRI also deferred the compliance date of certain requirements of the LCRR to allow for compliance with both new rules. The Company is in the process of developing an estimate of capital expenditures and operating costs needed to meet the specific requirements of the LCRI. Capital expenditures and operating costs associated with compliance with federal water quality regulations have been traditionally recognized by PUCs as appropriate for inclusion in establishing rates. 

The Company continues to comply with the EPA’s existing Lead and Copper Rule requirements by replacing lead service lines in accordance with current scientific guidance and utilizing appropriate corrosion control techniques as necessary to comply with current water quality regulatory requirements. 

The Company met the LCRR requirements, effective October 16, 2024, identified as enforceable by the EPA. Remaining LCRR requirements are deferred under the LCRI.

Cybersecurity Incident

On October 3, 2024, the Company identified unauthorized activity within its information technology computer networks and systems, which was determined to be the result of a cybersecurity incident. Upon identification of this activity, the Company immediately activated its incident response protocols and third-party cybersecurity experts to assist with containment and mitigation activities and to investigate the nature and scope of the incident. The Company also promptly notified law enforcement and has coordinated fully with them. As part of the incident response, and in order to protect its systems and data, the Company disconnected and deactivated certain of its systems, which have since been reconnected and reactivated upon verification that those systems were secure.

52

All necessary containment, mitigation and restoration activities related to this incident have been completed. None of the Company’s water or wastewater facilities were impacted by this incident, and the incident did not have a material effect on the Company or its financial condition or results of operations. In addition, a number of putative class action lawsuits have been filed in connection with this cybersecurity incident, primarily alleging claims related to federal and/or state consumer protection and data privacy laws