Fitch Ratings noted that cybersecurity threats, combined with resource constraints and regulatory inconsistencies, are creating a difficult operating environment for U.S. water systems; meanwhile, healthcare organizations are also facing increasing cyberattacks and upcoming regulatory requirements.

In two client-facinganalysis reports(shared with Cybersecurity Dive) released on Tuesday, August 18, analysts said these two critical infrastructure sectors are struggling because hackers are exploiting their outdated technology and low tolerance for operational downtime.

"Essential service delivery, increasing interconnectivity, and the limited financial and technical resources of many water systems collectively make water systems highly attractive targets for adversaries," Fitch experts wrote.

In the healthcare sector, analysts said: "Although rating actions related to cyberattacks have been limited to date, the cost and severity of cyber incidents are rising, and the likelihood of rating pressure is increasing."

These new assessments come as the water and healthcare sectors are receivingincreased cybersecurity attention, and water facilities are fending off ahacking campaign。

that U.S. officials have preliminarily attributed to the Iranian government. Early planning can help maintain ratings

Fitch said cyberattacks themselves rarely prompt analysts to change the credit ratings of affected organizations. Instead, ratings change when a cyberattack "exacerbates broader operational and financial challenges." The healthcare report noted that organizations with "healthy operating margins" rarely experience downgrades after a cyberattack.

Fitch analysts wrote that as long as they are prepared, organizations with strong credit ratings can maintain their favorable financial assessments even after a cyberattack.

"The institutions most likely to mitigate potential negative rating momentum are those that demonstrate operational resilience, possess robust incident response capabilities, effective business continuity planning, and have sufficient rating buffer to absorb the financial stress of a cyber incident," Fitch said in the healthcare report. Analysts expressed the same view in the water report.

However, for smaller healthcare organizations with financial constraints and limited cybersecurity experience, planning ahead for cyberattack responses is challenging. Analysts wrote that these institutions "are often more susceptible to sustained operational and financial stress, which could trigger negative rating momentum."

Positive outlook for HIPAA compliance

Fitch's healthcare report outlined several upcoming regulatory changes, most notably the U.S. Department of Health and Human Services (HHS) update to cybersecurity standards under the Health Insurance Portability and Accountability Act (HIPAA). Although HHS estimates the new security requirements could cost $33 billion over the next five years, Fitch said it does not expect its rated entities to face significant financial challenges from compliance.

"Even under a 2.0x stress test, Fitch expects no rating actions within its rated portfolio," the company said. "This is partly because rated entities have already implemented many of these proposed requirements, and these costs are low relative to the industry's median operating revenue."

Attacks could complicate rate increases

Fitch said cyberattacks against water facilities could create long-term challenges in a way that is not fully recognized.

Financially strained water facilities can only bear new cybersecurity measures or personnel costs by raising rates, a prospect that is politically challenging even under stable operating conditions. For example, a major hack that affects water supply or leaks customer data could severely undermine public confidence in water utility management. That loss of confidence could, in turn, make it politically difficult for the utility to raise rates.

Moreover, the small rural water facilities most vulnerable to cyberattacks are also precisely those least able to strengthen defenses through rate increases before an attack occurs.

Fitch analysts wrote: "These water facilities may not be able to fully pass on potentially significant costs because their customer base may struggle to afford substantial rate increases. As a result, margins could be impaired, liquidity and leverage could weaken, and negative rating pressure could build."