The Village of Red Hook has been awarded a $50,000 grant from New York State to assess the cybersecurity of its water system, as concerns have grown around the country in recent years about the vulnerability of infrastructure in smaller municipalities.
The money will be used to hire a third-party contractor who will carry out a review to identify which parts of the Village’s water system, if any, could be vulnerable to hacking and then recommend steps to fix them.
Village Engineer Robert Flores said smaller municipalities like Red Hook typically don’t have technologically sophisticated water systems, which makes them targets of cyberattacks. A successful attack could let hackers take control of water pumps or chemical feed systems, affecting how much water residents receive or the chemical makeup of the water, he said.
“Anybody who’s connected to the internet, there’s a potential… so the whole purpose of the grant is to triple check that it’s not possible,” Flores said.
Flores said he knows of at least two municipalities of similar size in Greene and Westchester Counties whose water systems have been hacked.
The grant also comes amid growing concern nationwide about cyberattacks on local water systems. In 2026, there were at least 100 attacks on municipal water systems across 12 states, according to the Center for Strategic and International Studies.
In response, Albany created a new grant program this year to help municipalities protect their water systems. In August, Gov. Kathy Hochul announced over $9 million in awards for 153 local government projects statewide. Some of the funded projects, like Red Hook’s, assess a system’s vulnerabilities. Others put security improvements in place.
Other nearby water systems were also awarded grants to assess their vulnerabilities, including the City of Kingston, East Fishkill, Hyde Park’s regional water system, and Central Dutchess’s water system.
According to the New York State Department of Health, common cybersecurity vulnerabilities in a locality’s water system include old computer systems and staff connecting work systems to unsafe wifi networks. Common signs of a cybersecurity attack are the water system operating in unusual settings, slow or frozen controls, and unexpected changes to the equipment or software.
The new grant also comes after Hochul announced new cybersecurity regulations for water systems that serve more than 3,300 people. These include ensuring operators receive basic cybersecurity training, adopting new cybersecurity incident reporting requirements, and reviewing and updating a cybersecurity vulnerability analysis annually. According to a 2024 Dutchess County report, the Village of Red Hook’s water system serves about 2,700 people, so the new regulations would likely not apply to it.
