Document qkRqnLzK4kwk79qNory1Gxzdq

ft E P A UnitedSlltes .,.,...., Envlronment1I Protectlor - Agen<y Region 6 - Enforcement & Compliance Assurance Division INSPECTION REPORT Inspection Date(s): Media Program : Regulatory Program(s) 11/13/2025 Water SDWA Company Name: Facility Name: Facility Physical Location: (city, state, zip code) Mailing address: (city, state, zip code) County/Parish : Facility Phone Number Facility Contact: City of Abilene City of Abilene City Hall 555 Walnut Street Abilene, TX, 79601 555 Walnut Street Abilene, TX, 79601 Taylor (325)-676-6471 Jeremiah Bihl Jeremiah.bihl@abilenetx.gov I I Assistant Director of Water Utilities FRS Number: Identification/Permit Number: Media Identifier Number: NAICS: SIC: PWSID#:TX2210001 - Personnel participating in inspection: Fatima Shaikh EPA Region 6 Abigail Williams EPA Region 6 Victoria Lavios Texas Commission on Environmental Quality David Spears City of Abilene Matt Hankins City of Abilene Kenny Hutchins City of Abilene Brandon Harris City of Abilene Andy Jordan City of Abilene Troy Swanson City of Abilene Jeremiah Bihl City of Abilene Matthew Dane City of Abilene Phillip Brewer City of Abilene Mike Harmon City of Abilene Inspector Inspector in Training Public Water System Investigator Water Production Supervisor Water Production District Manager Water Treatment District Manager Water Treatment USM Water Utilities Assistant Director CIO, IT Department Director Water Utilities Assistant Director Director of Water Chief Information Security Officer CTO, IT Department Assistant Director EPA Lead Inspector Signature/Date Digitally signed by FATIMA FATIMA SHAIKH SHAIKH Date: 202S.12.1910:34:13--06'00' {Inspector name} Date Supervisor Signature/Date RUBEN ALAYON-GONZALEZ Date: 2025.12.19 10:3~ :41 -06'00' Digitally signed by RU 3EN ALAYON-GONZALEZ {Supervisor name} Date 6ENFORM-020-R8.2 (02/12/2020) 1 Section I - INTRODUCTION City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 PURPOSE OF THE INSPECTION EPA inspectors Fatima Shaikh and Abigail Williams arrived at the City of Abilene City Hall at approximately 9:00 am on November 13, 2025, for an announced Safe Drinking Water Act (SOWA) inspection of the City of Abilene Water System, Public Water Supply (PWS) ID No. TX2210001. The inspection was prompted by a national priority targeting systems for the Region's SOWA 1433 Risk and Resiliency Assessment (RRA), Emergency Response Plan (ERP), and Cybersecurity inspection. We met with Matthew Dane, Director of Water, Jeremiah Bihl, Water Utilities Assistant Director, Andy Jordan, Water Utilities Assistant Director, David Spears, Water Production Supervisor, Matt Hankins, Water Production District Manager, Kenny Hutchins, Water Treatment District Manager, Brandon Harris, Water Treatment USM, Troy Swanson, CIO IT Department Director, Phillip Brewer, Chief Information Security Officer, Mike Harmon, CTO IT Department Assistant Director. Fatima Shaikh presented her credentials to the system representatives and informed them that this was an EPA inspection to evaluate the RRA, ERP, and cybersecurity practices under the SOWA Section 1433(a) and (b), which requires community water systems that serve more than 3,300 people to develop and certify completion of an RRA and ERP. Additionally, the inspection was also a part of the National Enforcement and Compliance Initiative (NECI) Measure 1.4 which aims to evaluate and address 50% of all Community Water Systems (CWS) serving populations greater than 10,000. This report summarizes observations made as part of the inspection, which consisted of the following activities: Evaluation of RRA, ERP, and Cybersecurity practices Site visit to the System's Northeast Water Treatment Plant (WTP) and Pump Station Photos taken during the inspection are in Appendix 2. FACILITY DESCRIPTION The City of Abilene Public Water System (PWS) is a community water system located in Abilene, Taylor County, Texas. The city has 81,477 service connections and serves a population of 125,182 customers according to Texas Drinking Water Viewer database. The water system is a surface water system with four surface water sources: Lake Fort Phantom Hill (LFPH), Hubbard Creek Reservoir, O.H. Ivie River, and Possum Kingdom Lake. The PWS consists of five treatment facilities: LFPH chlorine dioxide facility for pretreatment, Possum Kingdom RWRF, which is not operational Northeast WTP o Conventional Treatment o Rated at 25 million gallons per day (MGD) o Operated by the West Central Texas Municipal Water District Grimes WTP 2 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 o Conventional Treatment o Rated at 25 MGD o Operated by Colorado River Municipal Water District Hargesheimer WTP o Reverse Osmosis Treatment o Rated at 12 MGD o Operated by Brazos River Authority There are five pump stations, 12 distribution storage tanks (Pressure Storage (PS), Ground Storage Tank (GST), Elevated Storage Tank (EST)). The system has three major pressure planes, lower, middle, and upper; and two smaller planes which serve prisons, a business park, and supply water to the cities Tye, Merkel, and Clyde. The system supplies water to twelve purchasers: Sun WSC, Dyess Air Force Base, Hamby WSC, Hawley WSC, Hawley WSC, City of Tye, City of Merkel, View CAPS, City of Clyde/Baird, Potosi WSC, EULA WSC, Steamboat Mountain WSC. Additionally, there is a new data center that will be supplied by the City of Abilene. The PWS has 20 certified operators across all WTPs. The Northeast WTP and Grimes WTP are operated 24/7 with one operator per shift. There are three shifts: 5:30AM-1:30PM, 1:30PM-9:30PM, and 9:30PM5:30AM . The Hargesheimer WTP consists of an automatic shutoff. Cyber Incident On April 18, 2025, the City of Abilene experienced a cyber attack where the data was encrypted and deleted off servers (Appendix 3). The City responded by shutting down the network to prevent further loss of data. The City was able to restore the system back into operation in two weeks after the incident. It was determined that no significant information was retrieved from the network; however, some data was destroyed. There was also no significant impact to the water system as it is isolated from the network with static IP addresses and the plants operate on radios . The only impact on the water system was the loss of historical data which was destroyed in one of the servers. The City is working towards full recovery. The City received assistance from several entities post-cyber incident such as nonprofits and municipalities. The City of Midland and City of Carrollton provided assistance to the City. Section II - INSPECTION ACTIVITY SUMMARY The EPA Inspection Team conducted interviews and field visit to understand the WTP process and gather information regarding the RRA, ERP, and Cybersecurity. The TCEQ sanitary survey reports were provided prior to the inspection to help the inspection team get a general understanding of the PWS and compliance. The information in this report is based on documents review, conversations with the system representatives, and observations made during the inspection. The documents provided for review by the PWS during the inspection included : 3 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Risk and Resilience Assessment Emergency Response Plan Safety Data Sheets for chemicals INSPECTION PROCESS RRA and ERP Document Review The EPA Inspection Team reviewed the System's Section 1433 RRA and ERP and the system's cybersecurity practices. The team interviewed the system representatives using the list of cybersecurity questions for community water systems, which was provided to the water system prior to the inspection. Following the interview, the team reviewed and evaluated the RRA and ERP documents. Northeast Water Treatment Plant The inspection team conducted a brief walkthrough of the Northeast WTP. The WTP is supplied by Lake Fort Phantom and Hubbard Lake with a fifty-fifty split. The operator mentioned that the raw water quality at the lakes have higher levels of iron and manganese in the summer due to low water levels. The walkthrough began at the rapid mix vault where pretreated water with chlorine dioxide from the lakes is fed with addition of polymer, aluminum sulfate, ferrous sulfate, chlorine gas, and ammonia. The plant is undergoing trials to replace aluminum sulfate with aluminum chlorohydrate. Next, the clarifiers were observed. There are three up flow clarifiers. One clarifier is out of service for cleaning. The clarifiers are cleaned annually. The sludge from the clarifier goes to the pit, then to the lagoon. Every few hours, the clarifiers push the old sludge out as the new sludge comes in. The chlorine room was observed. Fifteen 1-ton gas cylinders can be stored at a time in the chlorine room. Six cylinders were observed, chlorine gas detector, vent, and crash bar door were observed. The ferrous chloride tank was observed outside. The operator noted that the chemicals are flow-paced. Next, the filters were observed. There are seven gravity sand filters, with one offline for repair. Two filters are backwashed daily based on water quality and head loss. The backwash water goes to the head of the plant for reuse. The water from the filters goes to the clear well. The east clear well was offline to be decommissioned. The west clear well is five million gallons. After the clear well, the water goes through the five high service pumps and out to distribution after the injection of chlorine and liquid ammonium sulfate {LAS). Next, the Supervisory Control and Data Acquisition {SCADA) room was observed. There is an alarm for tank levels. The plant demand in the summer is 36 MGD and in the winter is 20-22 MGD. Algae growth is observed in the lakes in the summer. The water quality is minimally affected by the algae. The operators can manually initiate the backwash, and the backwash process is automated. The targeted chlorine residual in the distribution is 4.5-4.6 mg/L. 4 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Northeast Pump Station The inspection team visited the Northeast Pump Station. The pump station serves the ist, 2nd, and 5th pressure planes. Pumps 1 and 2 can supply a large demand while pumps 3 and 4 supply a low demand. The greatest number of pumps that can be run at one time is three pumps. The residual reading on the chlorine sensor was 2.96 mg/L. The pump station consists of a diesel fueled backup generator that is exercised once a month. Section Ill-OBSERVATIONS/AREAS OF CONCERN The following observations pertain to the SOWA Section 1433{a), Risk and Resilience Assessment: SOWA Section 1433{a), 42 U.S.C. 300i-2, Community Water System Risk and Resilience requires a CWS serving more than 3,300 persons to conduct an RRA of its system, including an assessment of: a. the risk to the system from malevolent acts and natural hazards; b. the resilience of the pipes and constructed conveyances, physical barriers, source water, water collection and intake, pretreatment, treatment, storage and distribution facilities, electronic, computer, or other automated systems (including the security of such systems) which are utilized by the system; c. the monitoring practices of the system; d. the financial infrastructure of the system; e. the use, storage, or handling of various chemicals by the system; and f . the operation and maintenance of the system. Observation 1. On November 13, 2025, the EPA inspection team completed an inspection of Respondent's System under SOWA Section 1445, 42 U.S.C. 300j-4. The EPA inspection team requested to review Respondent's RRA and observed the following: a. Document was available at the time of the inspection. b. The RRA was dated to show that it was completed before the date of the certification of completion. c. The RRA did assess all required elements of Section 1433(a). d. The RRA did include a complete assessment of the required elements. The following observations pertain to the SOWA Section 1433{b), Emergency Response Plan: SOWA Section 1433{b), 42 U.S.C. 300i-2, Community Water System Risk and Resilience requires a CWS serving more than 3,300 persons to conduct an ERP of its system, including an assessment of: a. strategies and resources to improve the resilience of the system, including the physical security and cybersecurity of the system; b. plans and procedures that can be implemented, and identification of equipment that can be utilized, in the event of a malevolent act or natural hazard that threatens the ability of the CWS to deliver safe drinking water; c. actions, procedures, and equipment which can obviate or significantly lessen the impact of a malevolent act or natural hazard on the public health and the safety and supply of drinking 5 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 water provided to communities and individuals, including the development of alternative source water options, relocation of water intakes, and construction of flood protection barriers; and d. strategies that can be used to aid in the detection of malevolent acts or natural hazards that threaten the security or resilience of the system. Observation 2. During the inspection, EPA inspectors also reviewed Respondent's ERP and observed the following: a. Document was available at the time of the inspection. b. The ERP was dated to show that it was completed before the date of the certification of completion. c. The ERP did complete all required elements of Section 1433(b). d. The RRA did not include a complete assessment of the required elements. I observed the following areas or concern and/or the following information was provided, stated on November 13, 2025. Operations and Maintenance Observation 3 Observation 4 Observation 5. At the Northeast pump station, the GST had a gap on the bottom seal. (see Photo 19) Observation 6 Observation 7 Section IV - CLOSING CONFERENCE On November 13, 2025, the EPA inspection team conducted a closing conference at the City of Abilene City Hall at approximately 4:00 PM. The inspection team reviewed observations and areas of concern with the system representatives. The observations and concerns of the RRA, ERP, and cybersecurity were verbally discussed. 6 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Section V - FOLLOW UP No additional background information about the public water system was received after exiting the facility on November 13, 2025. Section V - LIST OF APPENDICES Appendix 1- Sign-in sheet Appendix 2 - Photograph Log Appendix 3 - Cyber Incident Article Appendix 4 - List of EPA Resources 7 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Appendix 1 Inspection sign-in sheet 8 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Name Title Representing D(4,..,;1 s e~ t.J,.1t/ f,Jk s,. ..w- k.J.-.nr p.,.L't>~ H-11'\r\ /?:- > (pA ~A- Co4 co ,l'-h'- cAoc GPA wA !-r; ~; ltJ,.ier Co V1do :~ Ler.V~" {)vs InJ. TcE P~,11,p Brew~, CISO (oPr t1.-1"0 Telephone No. 325'" 72/ 2f3'1 ,sz< 77-/ ,/Jo "JW 7ZI - tf111, Z :;25-Z"1-73rs ..Jc} s- 7tf2- /, ' fJ'i 31..f,-G1, -647/ 31? 7?-' ~ ;:i.7 r, 3 '2.5- 514 - q&.{8'"(, Fa.+- <;ku-_ .Lh Ab: :Irv; e(fur _, PA: 2P-\ - GC.S - 7 lit 21'-\- GG S -e,1~ 9 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Appendix 2 Photograph Log 10 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Unless otherwise indicated herein, all photographs were taken by Fatima Shaikh of EPA during the inspection. The displayed date and time are the local time (CST). Photographs were not manipulated beyond minor cropping for sizing and adding labels or callouts to draw attention to the subject of the photograph. Not all photographs taken during the inspection are included in the Photograph Log. 11 Facility: City: Photo Date: Photographer: City of Abilene Abilene 11/13/2025 Fatima Shaikh City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Photo No. l State : Time : Witness Name: TX 14:12 :33 Abigail Williams Description: I View of Rapid Mix Vault. 12 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Facility/Location: City: Photo Date: Photographer: City of Abilene Abilene 11/13/2025 Fatima Shaikh Photo No. 2 State: Time: Witness Name: TX 14:17:53 Abigail Williams Description: I View of coagulation process. 13 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Facility/Location: City: Photo Date: Photographer: City of Abilene Abilene 11/13/2025 Fatima Shaikh Photo No. 3 State: Time: TX 14:18:26 Witness Name: I Abigail Williams Description: I View of up flow clarifiers. 14 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Facility/Location : City: Photo Date: Photographer: City of Abilene Abilene 11/13/2025 Fatima Shaikh Photo No. 4 State: Time: TX 14:18:40 Witness Name: I Abigail Williams Description: I View of pumps. 15 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Facility/Location : City: Photo Date: Photographer: City of Abilene Abilene 11/13/2025 Fatima Shaikh Photo No. 5 State: Time : TX 14:25:24 Witness Name: I Abigail Williams Description: I View of up flow clarifiers. 16 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Facility/Location : City: Photo Date: Photographer: City of Abilene Abilene 11/13/2025 Fatima Shaikh Photo No. 6 State: Time : TX 14:25:26 Witness Name: I Abigail Williams Description: I View of fluoride bulk tank. 17 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Facility/Location: City: Photo Date: Photographer: City of Abilene Abilene 11/13/2025 Fatima Shaikh Photo No. 7 State: Time: TX 14:29:04 Witness Name: I Abigail Williams Description: I View of filter. 18 Facility/Location : City: Photo Date: Photographer: City of Abilene Abilene 11/13/2025 Fatima Shaikh City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Photo No. 8 State: TX Time: 15:27:28 Witness Name: I Abigail Williams Description: I View of bulk tank and clearwell. 19 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Facility/Location: I City of Abilene City: I Abilene Photo Date: I 11/13/2025 Photographer: I Fatima Shaikh Photo No. 9 State : Time: TX 15:28:28 Witness Name: I Abigail Williams Description: I View of east clearwell. 20 Faci Iity/Location : City: Photo Date: Photographer: City of Abilene Abilene 11/13/2025 Fatima Shaikh City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Photo No. 10 State: Time : TX 14:24:35 Witness Name: I Abigail Williams HAZARD CONANED SPfCE AIJlHORIZED CITY 1'RS()NNELOMY CITYOI'- Description: I View of Chlorine Room entrance. 21 Facil ity/Location : City: Photo Date: Photographer: City of Abilene Abilene 11/13/2025 Fatima Shaikh City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Photo No. 11 State: Time : TX 14:24:43 Witness Name: I Abigail Williams Description: I View of Ferrous Chloride bulk tank. 22 Facil ity/Location : City: Photo Date: Photographer: City of Abilene Abilene 11/13/2025 Fatima Shaikh City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Photo No. 12 State: Time : TX 14:22:54 Witness Name: I Abigail Williams Description: I View of bulk tanks. 23 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Faci Iity/Location: City: Photo Date: Photographer: City of Abilene Abilene 11/13/2025 Fatima Shaikh Photo No. 13 State: Time: TX 15:15:23 Witness Name: I Abigail Williams Description: I View of open vault and bulk tank. 24 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Facility/Location: City: Photo Date: Photographer: City of Abilene Abilene 11/13/2025 Fatima Shaikh Photo No. 14 State: TX Time: 15:29:29 Witness Name: I Abigail Williams Description: I View of operator board at Northeast WTP. 25 Faci Iity/Location: City: Photo Date: Photographer: City of Abilene Abilene 11/13/2025 Fatima Shaikh City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Photo No. 15 State: Time: TX 15:16:08 Witness Name: I Abigail Williams Description: I View of GST at Northeast pump station. 26 Facil ity/Location : City: Photo Date: Photographer: City of Abilene Abilene 11/13/2025 Fatima Shaikh City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Photo No. 16 State: Time : TX 14:12:26 Witness Name: I Abigail Williams Description: I View of GST at Northeast pump station. 27 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Facility/Location: City: Photo Date: Photographer: City of Abilene Abilene 11/13/2025 Fatima Shaikh Photo No. 17 State : Time: Witness Name: TX 14:24:45 Abigail Williams Description: I View of GST Overflow. 28 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Faci Iity/Location : I City of Abilene City: Abilene Photo Date: 11/13/2025 Photographer: Fatima Shaikh Photo No. 18 State: Time: Witness Name: TX 1 4:29 :10 Abigail Williams Description: I View of sample tap at GST. 29 Faci Iity/Location : City: Photo Date: Photographer: City of Abilene Abilene 11/13/2025 Fatima Shaikh City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Photo No. 19 State: Time: TX 15:24:36 Witness Name: I Abigail Willliams Description: I View of GST gap in seal. 30 Faci Iity/Location : City: Photo Date: Photographer: City of Abilene Abilene 11/13/2025 Fatima Shaikh City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Photo No. 20 State: TX Time: 14:59:01 Witness Name: I Abigail Williams Description: I View of Northeast pump station. 31 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Faci Iity/Location : I City of Abilene City: Abilene Photo Date: 11/13/2025 Photographer: Fatima Shaikh Photo No. 21 State: TX Time: 14:45:15 Witness Name: I Abigail Williams Description: I View of generator at Northeast pump station. 32 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Appendix 3 City of Abilene Cyber Incident Article 33 L City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 City of Abilene News Posted on: June 2, 2025 Information on the City of Abilene Cyber Attack The City of Abilene would like to thank residents for their patience and understanding over recent months as our organi zation began the work of identifying, circumventing, and recove ring from a cyber attack on ou r network. While ools RSS N.Qilly~ Categories ~gQ.!ig_, Q1Y. of Abilene News ~~~ Fire Department 34 City of Ab ilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 essential services continued through this time, we know the attack and its effects have caused frustration for the community. The City of Abi lene is grateful for everyone's support as we move forward from this event, and are now able to share more information about it. C) INFORMATION ON THE CITY OF ABILENE CYBER ATTACK Parks & Recreation ~ Your Abilene Investment News 1ill!:fily~ Public Notices Public Health News Water Utilities News Seniors Services News We are City of Abilene Public works News On the morning of April 18, 2025, City of Abilene officials detected that City servers were unresponsive. Around 4 a.m., the City's Information Technology department investigated the outage, and after determining a foreign actor had compromised the City's computer systems, the full network was shut down to prevent any further intrusion or data loss. "The City suffered a ransomware attack," said Troy Swanson, Director of Information Technology for the City of Abilene. "They encrypted data and deleted data off our servers." The City was given a deadline of May 27, 2025, to pay a ransom to restore the stolen data, estimated at 477 gigabytes. Comm unication has occu rred with the suspect hacking group cla iming responsibility to ascertain the nature of the information taken . However, t he City determined it will not 35 City of Ab ilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 aid or abet the perpetrators otherwise, and will not pay the ransom . "I was involved in the acqu isition of our cyber insurance because of my role in overseeing risk management," said Mike Pe rry, Director of t he City's Offi ce of Profess ional Standards. "Fortunately for us, we increased ou r insurance coverage last year." Perry has used his background in law enforcement as a former Assistant Ch ief of Po lice to help direct invest igation efforts related to the recent cyberattack. Perry said his role as an admin istrator has in part been t o work with t he cybersecurity team hired by t he city's insurance company to help mitigate da mage and help with recovery efforts. As of May 28, 2025, there is no indication the City's information has been misused by the threat actors, he said. There also is no evidence that residents' information has been used or released by the hacking group, he said. Perry said the investigation is ongoing, and the exact information taken by the hackers is unclear. However, the amount taken appears to be relatively smal l compared to the City's total storage capacity. 'We're currently in this pattern of waiting to see if and when they're going to publish the data," he said. ''There's not a lot more dialog to be had because we've told them we're not going to pay the ransom." 36 City of Ab ilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 The Hack and Its Afte rmath The hacking group was able to compromise the City's network and ultimately access admin istrative credentials, Swanson said. They also attempted to uninstall antivirus software and remove other protective measures. The City turned off its network around 7 a.m. on April 18 after the breach was discovered. 'We are in the process of replacing all the network infrastructure, including servers, storage, and all the desktops and laptops," Swanson said. "By doing so, we will create a new cyber secure environment that we can assure is set up for the future and not able to be compromised." The City was able to restore core services quickly, Swanson said . "Our main push is to get desktops and laptops back in the employees' hands so they can continue to perform their functions," he said. "In many cases, there have been stopgap measures or interim measures to perform work, but we have many time-bound and funding-bound business practices that we are standing back up, and we've been relatively successful at that." Wh il e t here still will be hurdles to overcome, residents and employees should expect the majority of day-to-day functionality to be restored soon, he said. The City hopes to be at fu ll functionality in a few months, Swanson said. 37 City of Ab ilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Dealing in Data Perry said when threat actors attack a network, they encrypt data so that it's hidden from the entity it belongs to, then ask for a ransom to unencrypt and recover it. Wh ile t he data may be valuab le, "we're also not going to bow down to a criminal organization," said Perry, who was an Assistant Chief of Police in Abilene for 12 years before taking on his current ro le. Paying a ransom is no guarantee that the data will be recovered or that it won't be sold on the so-ca lled "Dark Web" anyway. ''You're stil l dealing with thieves, and is there such a th ing as an honorable thief?'' Pe rry sa id. Cyberattacks are an ongo ing th reat in the digital landscape, Swanson said, and are a new type of emergency organizations both public and private must endure. Hackers seek a variety of data, from personal information to financial and medical records, he said. 'When we th ink of disaster preparedness, in our area we think about tornadoes and floods and things like that," Swanson said. "But we' re entering an age where there's a higher probability of a cyber attack than there are some of those natural disasters. This may not be the first one we endure, and so that's why we're working to stand up a new network that's as cyber secure as possible." 38 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 It is difficult to know whether the group wi ll release the full payload of stolen information or not. But all in all, Perry said, 'We were very fortunate in a lot of ways." "Operations didn't stop," he sa id. 'We were still able to answer calls for service, for police, for fire. Our water service continued to operate. We didn't lose critical infrastructure." Even though this has all been very uncomfortable and difficult for employees and citizens, critical services have continued - and that's a good thing. Residents, City of Abilene Employees Can Protect Against Cyberattack Fallout Data breaches in general are on the rise, Perry sai d, and most people have been notified in the past by a credit card company or business that their data may have been compromised. In response to this environment, it's important for both City employees and residents to actively monitor their credit card and other accounts for data breaches. Credit cards and many bank accounts have free monitoring services, and it makes se nse to use them, Perry said. "The best thing you can do for yourse lf, especially if you 're not a frequent credit user, is to freeze your credit report to the three major agencies," he said, referring to Equifax, Experian, and TransUnion. 39 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Credit agencies collect and store information to help lenders and employers evaluate a person's rel iabi lity. They gather information from a variety of sources, including banks, credit card issuers, auto lenders, mortgage lenders, debt collection agencies, court records, and bankruptcy filings . ''The other thing to do is make sure that your passwords are routinely updated and that your passwords are unique," he said. Perry sa id he makes use of a password generator and virtual private network, or VPN, service to further protect himself from hackers. Those services are worth the investment, he said. "If you're not monitoring your accounts, if you're not monitoring credit, you're behind the times, beca use it's going to sting you," he said. Facts About the April 18, 2025, Cyberattack Against the City of Abilene o Working with cybersecurity experts, its in su rance company, and their cybersecurity attorney, the City initially focused on ensuring critical systems were up and running. o All City of Abilene computers and servers were taken offline. o Shortly after the attack, a known hacking group began communicating and exchanging information regarding 477 gigabytes of data the group alleged ly stole. 40 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 o Efforts to ascertain the exact nature of the sto len data continue, even though the group's demands for money in exchange for the files and decryption tools will be ignored. o As of now, temporary computers have been deployed in key locations to ensure all essential functions are ope rational. The City has also begun providing permanent desktop replacement computers to employees. The City's network is being rebuilt to ensure its cybersecurity. o Desk phones are in the process of being rep laced, which has caused methods of contact with various departments and personnel to change. Current City of Abilene contact information for residents can be found by clicking the information bar at the top of www.abilenetx.gov. o Employees have been reminded of best practices for protecting their data from unauthorized access and attacks. There is no evidence that employee data has been use d maliciously as of this writing. o As the City's infrastructure ha s been rebuilt, the public has experienced some delays and, in rare cases, a temporary return to pen-and-paper systems. However, network functionality wil l be restored and the City of Abilene will release periodic updates until all functions and points of access are fully operational. o Th e City will provide access to privacy protection services to all employees potentially affected by the breach. Details wi ll be released through internal channels to emp loyees. 41 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 o As warranted, the City will release information about the investigation, but its ongo ing nature limits what can be shared w ithout compromising those efforts. How much data is 477 gigabytes? o Documents {PDFs, Word fi les): -238,500,000 pages of text {at -2 MB per 1,000 pages), or o MP3 Songs (at 5 MB per song): - 95,400 songs, or o Photos {high quality, -5 MB each): -95,400 photos, or o 4K Movies {at -20-25 GB each): -19-23 full -length movies, or o Netflix Streaming {4K): - 48 hours of stream ing (at -10 GB/hour), or o Emails {text only, -75 KB per email): -6.4 million emails, or o Cell phones: 256 GB= 1.86 iPhones, or one less than 512 GB iPhone. Cities and Municipalities Recently Affected by Cyberattacks Baltimore, Maryland o Incident: 2019 ra nso mware attack causing more than $19 million in damages. o Departments Affected: City services including email systems, payment platforms, an d real estate transactions . o Update: In May 2025, Iranian national Sina Gholinejad pleaded guilty to charges related to this attack and similar incidents targeting other U.S. cities, in cluding 42 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Gresham, Oregon; Yonkers, New York; and Greenville, North Carolina. Mission, Texas o Incident: February 2025 cyberattack exposing personal and health records, as well as civi l and criminal data. o Departments Affected: Police Department (loss of access to state databases), municipal servers. o Response: The city requested a state of emergency declaration from Governor Greg Abbott._ Cleveland, Ohio o Incident: Early 2025 cyberattack disrupting Municipal Court system s. o Departments Affected : Mun icipal Court (postponement of trials and court operations). Richardson, Texas o Incident: September 2024 cybersecu rity incident affecting municipa l services. o Departments Affected: Various city departments; specific detai ls not disclosed. Wayne County, Michigan o Incident: October 2024 cyberattack disrupting county government services. o Departments Affected : County services; hackers demanded a ransom. 43 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 White Lake Township, Michigan o Inci dent: November 2024 cyberattack resulting in the theft of approximately $30 mill ion. o Departments Affected : Township financial systems. Arkansas City, Ka nsas o Incident: September 2024 cyberattack on the water treatment facility. o Departments Affected : Water Treatment Facility (forced to switch to manual operations). El Cerrito, California o Incident: August 2024 ransomware attack attributed to the LockBit group. o Departments Affected: City services. Killeen, Texas o Incident: August 2024 cybersecurity incident impacting municipal services. o Departments Affected : Various city departments. These incidents underscore a broader trend of increa sing cyber threats targeting local governments across the United States. Between 2018 and 2024, there were 525 reported ransomware attacks on U.S. government entities, resu lting in an estimated $1.09 billion in downtime. The surge in 44 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 attacks has been attributed to both financially motivated cybercriminals and state-sponsored actors from countries li ke Russia, China, an d Iran. The growing frequency and sophistication of t hese attacks have prompted calls for en hanced cybersecurity measures at the local level, including increased funding, better infrastructure, and stronger collaboration between federal and state agencies to protect critica l services and data. ::: prey jous Best Contact Numbers and Emails for City ~ Next ~~P-P-!!irfil fmi!Y. Crawford asNew City Mi!llilger Other News in City of Abilene News Abilene Regilmfil.Airport to host TSA PreCheck Enrollment Event November 3-7 Posted on: September 26, 2025 my of Abilene Diversifies West Nile Virus Prevention Efforts Posted on: September 18, 2025 I Last Modified on: September 18, 2025 City of Abilene Announces Op_e.o.ing..2f .... ParkMobile Lot Posted on: September 16, 2025 Phase 3 of Cy1:1ress Street Projen.ID:irlgs New Closures Downtown Posted on : September 10, 2025 45 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 Appendix 4 List of EPA resources 46 City of Abilene PWS ID#: TX2210001 Inspection Date: 11/13/2025 The following factsheets were shared with the system after the inspection: EPA AWIA Community Water System ERP Template and Instructions EPA AWIA Risk and Resilience Assessment Guidance EPA RRA and ERP Factsheet EPA Incident Action Checklist Cybersecurity EPA Cyber Incident Reporting Process Top Cyber Actions for Securing Water Systems Free Cyber Vulnerability Scanning for Water Utilities EPA Guidance on improving Cybersecurity at Drinking Water and Wastewater Systems 47