Stock photo via Pexels
Cyberattacks targeting Pennsylvania’s electric, water, and gas utilities have grown sharply in volume and sophistication, utility executives and cybersecurity experts told a Pennsylvania House panel on September 5, according to the Pennsylvania Capital-Star, whose reporter Ian Karbal covered the hearing.
The session was held before the House Consumer Protection, Technology and Utilities Committee’s subcommittee on utilities.
Brian Harrell, chief security officer at FirstEnergy Pennsylvania, told lawmakers his company’s defensive systems fend off tens of thousands of automated malicious connection attempts against public-facing services every month.
FirstEnergy serves roughly 2.1 million electric customers across 56 Pennsylvania counties. The numbers are staggering.
Harrell said the figures show why cybersecurity demands constant attention and ongoing improvement.
Costs Fall on Ratepayers and Smaller Authorities
Witnesses agreed that cybersecurity spending has become nearly as essential as capital investment in physical infrastructure — but cautioned that the costs ultimately reach ratepayers.
Craig Fahnestock, director of government relations for the Pennsylvania Municipal Authorities Association, told the panel that digital defense now competes directly with spending on pipes, pumps, and other physical improvements.
His organization represents close to 700 municipal water authorities, many of them small rural systems with limited budgets.
Fahnestock asked lawmakers to ensure that any new cybersecurity requirements come with funding or state-facilitated access to technical expertise.
Samit Nair, chief information officer at Essential Utilities, the parent company of Aqua Pennsylvania and People’s Natural Gas, said his firm has avoided any incident that disrupted service or caused material financial harm.
He attributed that record in part to treating cybersecurity outlays the same way the company treats investment in treatment plants and distribution systems.
Nair also flagged the cost of mandatory cybersecurity insurance, noting that premium rates depend heavily on a company’s demonstrated security practices.
AI Gives Attackers a Speed Advantage
Attackers have a new edge.
Jeremy Young, president and CEO of Federal Resources Corporation, a firm that provides cybersecurity services to government and public-sector clients, warned the panel that artificial intelligence has made the threat environment worse.
Attackers now use automation and AI to speed up reconnaissance, phishing, and vulnerability discovery, he said.
A utility may need to defend thousands of employees, devices, suppliers, and systems simultaneously, while an attacker needs only a single opening.
Panel Chair Calls for a Unified Response
Rep. Pat Gallagher (D-Philadelphia), who chairs the subcommittee, said bad actors are trying to manipulate or disable the control systems that deliver electricity, heat, and clean water to communities.
Gallagher called for a response that brings together private operators, public regulators, state agencies, and both political parties. No specific legislation was under discussion at the hearing.
Still, Fahnestock and other witnesses urged lawmakers to weigh compliance costs carefully before imposing new mandates on smaller authorities.