America's water fails most where people can least afford it.
The country has let its water systems run down, and when one gives out it is usually in a poor town. Every failure on this record that left residents without safe water happened in a community earning under three-quarters of the national median. The repair money and the rules have gone elsewhere. And the one threat that is still getting worse, cyberattacks on the plants themselves, has no federal rule at all. This page counts what that neglect has cost, and makes the case for paying to end it.
1What neglect looks like
Old pipes, small systems, no money
A water system doesn't fail on the day the taps run dry. It fails over decades, and the systems with the least money fall furthest behind.
Pipes past their useful life
Roughly 450,000 miles of water main should already have been replaced. Fixing breaks costs about $2.6 billion a year. ASCE's grade: C−, same as in 2021.
Most systems are small
Of the country's roughly 50,000 community water systems serve fewer than 3,300 people. They account for most violations, because a town that small can't pay for the staff or the upgrades.
Rates pay for repairs
Of households served by the biggest utilities already can't afford their water bill. Repairs are paid for through rates, so the poorest towns are the ones that can't raise the money.
Basic cyber requirements unmet
Of systems EPA inspected since September 2023 violated basic cybersecurity requirements. 97 large systems had critical or high-risk flaws.
2Who pays for it
The worst failures happened in the poorest places
The chart puts each incident on two scales: how much the affected community earns compared with the typical American household, and how bad things got for residents. The failures that made people sick or shut off safe water for weeks are all on the left side, in towns earning between a third and two-thirds of the national median.
Incomes are Census estimates for the city or county (ACS five-year via QuickFacts; Braham via Census Reporter), checked for every incident. The US median is $80,734. American Water and California Water Service cover too many towns to place. Fifteen incidents can't prove a correlation on their own, which is why the national studies sit next to the chart. Hackers pick water plants by what's exposed to the internet, not by what the town earns.
3Where it happened
Where the water failed, and where the lead pipes still are
Bigger circles mean bigger systems. The color shows whether the town earns more or less than the typical American household. The other layers show the incidents by cause, or how many lead pipes each state still has. Click a circle for the full record.
Circles sit at the utility's location; the Minnesota campaign hit more than 30 systems and is placed at Braham. The lead layer uses the bands EPA used to split FY2025 funding, which count lead lines plus galvanized lines that need replacing. State incomes come from the 2023 Census ACS one-year survey; town incomes are described above. Puerto Rico is inset.
4What it cost
Neglect costs more than any attack
Pick a measure. Flint, Jackson and Milwaukee come out on top of every one, and all three started with a decision to save money on treatment or upkeep. The cyberattacks hit utilities serving millions of people, but only one of them, Clayton County, actually cost residents safe water, and that was for a few hours.
5Where the money and the rules go
Rules come fast for security threats and slow for poor towns
Each bar starts at a disaster and ends at the first federal rule that was binding and addressed its cause. When Washington treated something as a national security problem, a rule came within weeks or months. When the problem was contaminated water, it took years, even after people died. Flint waited ten and a half years for a rule on lead pipes.
The clock on water cyberattacks started in February 2021 and is still running: 5.7 years, no binding rule.
Start dates: Colonial Pipeline May 7, 2021; September 11, 2001; Milwaukee April 1993; the 1969 federal Community Water Supply Study; Flint's April 2014 switch; Oldsmar February 2021, the first widely reported attack on a US water plant's controls. Hollow dots mark funding, proposals and reversed rules.
What prevention would have cost
In both cases, the fix would have cost almost nothing compared with the failure.
a day for corrosion control, the widely reported estimate. About $55,000 over 18 months.
settlement alone, before pipe replacement and federal aid.
to change default passwords and take controls off the open internet, CISA's first advice after Aliquippa.
run by hand at Arkansas City, and $163,751 in response costs.
Who the repair money reaches
The main federal program for fixing water systems is a loan fund. The towns with the worst water have been the least likely to get it.
Smaller communities and communities with more residents of color were statistically less likely to get a loan from the $45 billion program.
of the money went out as grants or forgiven loans. Federal law allows 35%. The rest was debt, which a poor town has to repay through rates.
Violations in counties with more residents of color and lower incomes were more likely to go unresolved for years. Towns under 3,300 people account for 80% of all violations.
from the Colonial Pipeline attack to a binding federal security directive, in the chart above.
6The threat that is climbing
Cyber is the one failure that keeps getting worse
Every incident gets a score for the worst thing residents went through. Contamination and broken infrastructure have already reached the top rung. Cyber started at the bottom and has climbed one rung at a time: the early attacks did nothing residents could notice, later ones forced plants to run by hand, then caused overflows and pressure drops, and in July 2026 one led to a boil-water advisory. None has made anyone sick yet. More than 70% of inspected systems still fail basic cyber requirements, and there is still no binding federal rule.
7Every incident
All 17 incidents, with the numbers behind each one
Click a row to find it on the map.
| When | Incident | Cause | Severity | People served | Days without safe water | Ill | Deaths | Disclosed cost | Boil notice | Town median income |
|---|
US incidents only. Cyber incidents from the Machine Speed water record, as of Oct 13, 2026; most utilities have no duty to report, so this is a floor. “—” means not published.
8What this adds up to
We can't keep ignoring this
The record on this page says four things.
The country has let its water systems run down. EPA puts the repair bill at $625 billion, a fifth of the pipe is already past its life, and 10,769 systems broke a health standard last year.
The people who pay for it are the people with the least. Every failure here that left residents without safe water happened in a community earning under three-quarters of the national median. The national studies say the same thing at scale.
The money and the rules go elsewhere. A pipeline attack got a binding federal rule in weeks. Flint waited ten and a half years. The federal repair fund was least likely to reach the small, poor, diverse towns whose water is worst, and most of what it sent was debt.
Cyber is the one that is still getting worse. Five and a half years after Oldsmar, attacks have climbed from no effect to a boil-water advisory, most systems still fail basic requirements, and there is no rule.
In 2010 the UN General Assembly voted 122 to 0 to recognize safe drinking water as a human right. The United States abstained. Sixteen years later, 28 million Americans can't afford their water bill and four million lead pipes still carry water into homes. Water security is not a luxury to fund when there is money left over. It is the thing the rest depends on, and it is time to pay for it.
UN General Assembly resolution 64/292, July 28, 2010: 122 in favor, none against, 41 abstentions. UN record · US statement
9How to read this page
What each number means
People served is the population of the system hit, not the number harmed. Days without safe water counts outages and boil-water or do-not-drink periods; Flint counts from the April 2014 switch to late 2016, when lead tested below the federal action level. Disclosed cost is what was published: a settlement, an aid package or a response bill. Lost-service value applies FEMA's $138 per person per day (2022 dollars) to people who lost drinkable water, and is an estimate, not a measured loss.
Limits
- Costs are not comparable across incidents: Flint's is a legal settlement, Jackson's federal aid, Milwaukee's the cost of illness in 1993 dollars.
- Flint's lead harm is not in the illness count: 6,000 to 12,000 children were exposed to lead.
- Clayton County's advisory length was not published; its lost-service value assumes about six hours, the record's convention for “within hours.”
- Town incomes are Census estimates for the city or county; poverty and race figures for the eight smallest towns are approximate. They describe the community, not the people who lost water. State incomes are rounded to the nearest $1,000.
- The income chart is fifteen data points: a pattern, not a correlation you can put a number on. Poverty and race figures for eight small towns are approximate (incomes are checked), and hackers choose targets by what's reachable online, not by income. The evidence that poorer communities get more violations and slower fixes comes from the national studies cited next to the chart: Allaire 2018 and 2022, NRDC 2019, Mueller and Gasteyer 2021.
- Milwaukee's income is today's; the city was poorer in 1993. For Puerto Rico, the island-wide figure stands in for PRASA's customers, who are about 97% of residents.
- Legionnaires' clusters from building cooling towers, such as New York City's in July 2026, are excluded: the source was not the public water supply, and tap water stayed safe to drink.
- Lead bands are read from EPA's published map; exact state counts are in EPA's 2025 service line projections.
Sources: EPA compliance report (CY2024), EPA Report on the Environment, Healthy People 2030, EPA 2025 DWINSA update, ASCE 2025 Report Card, CRS R47315, FEMA BCA, Corso et al. (CDC Emerging Infectious Diseases, 2003), and press and agency reports linked in each incident.