Top
Recent attacks cause limited disruption and signal broader warning
Cyber attackers have targeted water and wastewater utilities in at least 12 states over the last two months, highlighting vulnerabilities among essential-service providers. In late July, the FBI and Environmental Protection Agency said attackers disrupted remote monitoring and control systems at more than 30 Minnesota municipal water facilities by changing IP addresses and passwords. The agencies advised utilities to remove programmable logic controllers—computers that process sensor data and control pumps and valves—from the internet, use secure gateways and firewalls, maintain unique passwords, and restrict device access.
Authorities have not disclosed an official motive, but investigators suspect the incidents were retaliatory operations linked to the U.S.-Iran conflict rather than ransomware attacks. In our view, the perpetrators likely intended to disrupt water services, undermine public confidence in the government, and demonstrate their ability to target critical U.S. infrastructure.
These incidents illustrate the value of operational resilience amid rising cyber and operational risks. In late July, a pump failure forced a treatment plant offline in Braham, Minnesota. This prompted the utility to ask consumers to conserve water and required deployment of a backup tank. The plant restored services in around 90 minutes, and officials said the water remained safe. Elsewhere in the country, similar incidents have caused only brief disruptions because operators generally were able to shift to manual controls.
Cyber defense is critical but can increase credit risk
Elevated risk scenarios especially pose a challenge for smaller municipal systems, which often have constrained technology budgets, limited cybersecurity staff, and substantial existing capital requirements. The need to defend against cyberattacks increases capital spending for municipal systems which may then pass the higher costs on to customers through service rate increases. Yet the alternative is undesirable, as utilities that fail to prepare for digital attacks run the risk of allowing brief operational outages to escalate into sustained financial disruptions.
There is relief in sight for municipal systems due to new reporting standards and additional capital that has come online. For instance, the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), set to be finalized this year, is a federal rule that requires covered utilities to report significant incidents within 72 hours and ransomware payments within 24 hours. Additionally, some regions are stepping up their funding commitments. In August, New York State announced more than $9 million in grants for 153 local government projects through its Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancement (SECURE) program.
Still, an uptick in incidents illustrates why we assess cyber risk through both sector exposure and issuer-level preparedness. Overall, we evaluate whether an issuer can prevent, contain and recover from an incident without sustained pressure on operations, cash flow or customer confidence.
How we evaluate cyber risk
We first assign each municipal sector a low, moderate or high-risk score based on three factors:
- Essential systems
Critical-service providers face greater exposure because prolonged downtime raises the pressure to restore services quickly. Less essential sectors generally create fewer knock-on effects. - Digitalization
Greater reliance on connected operational and administrative systems increases potential entry points for attackers. - Financial impact and capacity
Strong balance sheets may attract attacks but also support better defenses and faster recovery. For weaker issuers, restoration costs can weigh more heavily on liquidity and operations.
Cyber Risk by Sector:
This represents how the portfolio management team generally implements its investment process under normal market conditions.
Cyber Risk by Sector:
We evaluate an issuer’s preparedness for a cyberattack across five areas:
Management awareness: Knowledge of organization-specific threats, openness about vulnerabilities, and familiarity with attacks on industry peers.
Technical and procedural controls: We look for the existence of backup systems, encryption, patch management, multifactor authentication, penetration and vulnerability testing, tabletop exercises, and employee cybersecurity training.
Response governance: Municipal entities need a documented incident response plan, dedicated information security resources, and clear accountability, including the appointment of a Chief Information Security Officer where appropriate.
Cyber insurance: Issuers should have sufficient coverage to mitigate material incident costs and exposures, including data recovery, business interruption, liability, forensics, crisis management, and regulatory costs.
AI readiness: Entities should recognize that while generative AI can exacerbate phishing, voice and identity impersonation, and the discovery of unpatched vulnerabilities, it can also be used to strengthen defensive systems—and personnel training should evolve accordingly.
Municipal credit risk and incident preparedness
Ultimately, cyber risk becomes municipal credit risk when an issuer lacks the operational, financial or governance capacity to absorb an attack without sustained disruption to essential services, operations or bondholders. Our municipal research team treats cyber risk as an integral part of credit analysis rather than a peripheral consideration.
In sectors we identify as high risk, analysts assess the quality of cybersecurity management alongside traditional credit factors and incorporate that assessment into our recommendations. Because municipal cyber disclosure remains voluntary, inconsistent and largely retrospective, screening tools or ratings alone provide limited insight. Instead, we apply a consistent risk-tolerance ranking across sectors and evaluate preparedness before an incident—not just losses afterward. We view this approach as a durable analytical advantage in a market where most participants learn of cyber events only after affected entities disclose them.
Featured Insights
RISK CONSIDERATIONS: The value of investments held by a Strategy may increase or decrease in response to economic, and financial events (whether real, expected or perceived) in the U.S. and global markets. There generally is limited public information about municipal issuers. As interest rates rise, the value of certain income investments is likely to decline. Investments in debt instruments may be affected by changes in the creditworthiness of the issuer and are subject to the risk of non-payment of principal and interest. The value of income securities also may decline because of real or perceived concerns about the issuer’s ability to make principal and interest payments. Income from tax-exempt municipal obligations could be declared taxable because of changes in tax laws, adverse interpretations by the relevant taxing authority or the non-compliant conduct of the issuer of an obligation. A portion of the Strategy’s distributions generally will be subject to the federal alternative minimum tax. The Strategy may not be suitable for investors subject to the federal alternative.
IMPORTANT INFORMATION
A separately managed account may not be appropriate for all investors. Separate accounts managed according to the Strategy include a number of securities and will not necessarily track the performance of any index. Please consider the investment objectives, risks and fees of the Strategy carefully before investing. A minimum asset level is required. For important information about the investment managers, please refer to Form ADV Part 2.
The views and opinions expressed and/or analysis are those of the investment team as of the date of preparation of this material and are subject to change at any time without notice due to market or economic conditions and may not necessarily come to pass. Furthermore, the views will not be updated or otherwise revised to reflect information that subsequently becomes available or circumstances existing, or changes occurring, after the date of publication. The views expressed do not reflect the opinions of all investment personnel at Morgan Stanley Investment Management (MSIM) and its subsidiaries and affiliates (collectively “the Firm”) and may not be reflected in all the strategies and products that the Firm offers.
This material is a general communication, which is not impartial and all information provided has been prepared solely for informational and educational purposes and does not constitute an offer or a recommendation to buy or sell any particular security or to adopt any specific investment strategy. The information herein has not been based on a consideration of any individual investor circumstances and is not investment advice, nor should it be construed in any way as tax, accounting, legal or regulatory advice. To that end, investors should seek independent legal and financial advice, including advice as to tax consequences, before making any investment decision.
This material has been prepared on the basis of publicly available information, internally developed data and other third-party sources believed to be reliable. However, no assurances are provided regarding the reliability of such information and the Firm has not sought to independently verify information taken from public and third-party sources.
This material is not a product of Morgan Stanley’s Research Department and should not be regarded as a research material or a recommendation.
The Firm has not authorised financial intermediaries to use and to distribute this material, unless such use and distribution is made in accordance with applicable law and regulation. Additionally, financial intermediaries are required to satisfy themselves that the information in this material is appropriate for any person to whom they provide this material in view of that person’s circumstances and purpose. The Firm shall not be liable for, and accepts no liability for, the use or misuse of this material by any such financial intermediary.
This material may be translated into other languages. Where such a translation is made this English version remains definitive. If there are any discrepancies between the English version and any version of this material in another language, the English version shall prevail.
The whole or any part of this material may not be directly or indirectly reproduced, copied, modified, used to create a derivative work, performed, displayed, published, posted, licensed, framed, distributed or transmitted or any of its contents disclosed to third parties without MSIM's express written consent. This material may not be linked to unless such hyperlink is for personal and non-commercial use. All information contained herein is proprietary and is protected under copyright and other applicable law.
DISTRIBUTION
This material is only intended for and will only be distributed to persons resident in jurisdictions where such distribution or availability would not be contrary to local laws or regulations.
MSIM, the asset management division of Morgan Stanley (NYSE: MS), and its affiliates have arrangements in place to market each other’s products and services. Each MSIM affiliate is regulated as appropriate in the jurisdiction it operates. MSIM’s affiliates are: Calvert Research and Management, Eaton Vance Management, Parametric Portfolio Associates LLC, Parametric SAS, and Atlanta Capital Management LLC.
This material has been issued by any one or more of the following entities:
EMEA:
This material is for Professional Clients/Accredited Investors only.
In the EU, MSIM materials are issued by MSIM Fund Management (Ireland) Limited (“FMIL”). FMIL is regulated by the Central Bank of Ireland and is incorporated in Ireland as a private company limited by shares with company registration number 616661 and has its registered address at 24-26 City Quay, Dublin 2, DO2 NY19, Ireland.
Outside the EU, MSIM materials are issued by Morgan Stanley Investment Management Limited (MSIM Ltd) is authorised and regulated by the Financial Conduct Authority. Registered in England. Registered No. 1981121. Registered Office: 25 Cabot Square, Canary Wharf, London E14 4QA.
In Switzerland, MSIM materials are issued by Morgan Stanley & Co. International plc, London (Zurich Branch) Authorised and regulated by the Eidgenössische Finanzmarktaufsicht ("FINMA"). Registered Office: Beethovenstrasse 33, 8002 Zurich, Switzerland.
Italy: MSIM FMIL (Milan Branch), (Sede Secondaria di Milano) Palazzo Serbelloni Corso Venezia, 16 20121 Milano, Italy. The Netherlands: MSIM FMIL (Amsterdam Branch), Rembrandt Tower, 11th Floor Amstelplein 1 1096HA, Netherlands. France: MSIM FMIL (Paris Branch), 61 rue de Monceau 75008 Paris, France. Spain: MSIM FMIL (Madrid Branch), Calle Serrano 55, 28006, Madrid, Spain. Germany: Germany: MSIM FMIL (Frankfurt Branch), Grosse Gallusstrasse 18, 60312 Frankfurt am Main, Germany (Gattung: Zweigniederlassung (FDI) gem. § 53b KWG). Denmark: MSIM FMIL (Copenhagen Branch), Gorrissen Federspiel, Axel Towers, Axeltorv2, 1609 Copenhagen V, Denmark.
MIDDLE EAST
Dubai International Financial Centre: This information does not constitute or form part of any offer to issue or sell any investment products in the UAE (including the Dubai International Financial Centre and the Abu Dhabi Global Market) and accordingly should not be construed as such. The content of this report has not been approved by or filed with the UAE Central Bank, the Dubai Financial Services Authority, the UAE Securities and Commodities Authority or the Financial Services Regulatory Authority.
Abu Dhabi Global Market ("ADGM"): This material is sent strictly within the context of, and constitutes, an Exempt Communication. This material relates to (strategy) which is not subject to any form of regulation or approval by the Financial Services Regulatory Authority of the Abu Dhabi Global Market (the “FSRA”).
Saudi Arabia
This financial promotion was issued and approved for use in Saudi Arabia by Morgan Stanley Saudi Arabia, Al Rashid Tower, Kings Sand Street, Riyadh, Saudi Arabia, authorized and regulated by the Capital Market Authority license number 06044-37.
US
NOT FDIC INSURED | OFFER NO BANK GUARANTEE | MAY LOSE VALUE | NOT INSURED BY ANY FEDERAL GOVERNMENT AGENCY | NOT A DEPOSIT
Latin America (Brazil, Chile Colombia, Mexico, Peru, and Uruguay)
This material is for use with an institutional investor or a qualified investor only. All information contained herein is confidential and is for the exclusive use and review of the intended addressee and may not be passed on to any third party. This material is provided for informational purposes only and does not constitute a public offering, solicitation, or recommendation to buy or sell for any product, service, security and/or strategy. A decision to invest should only be made after reading the strategy documentation and conducting in-depth and independent due diligence.
ASIA PACIFIC
Hong Kong: This document has been issued by Morgan Stanley Asia Limited, CE No. AAD291, for use in Hong Kong and shall only be made available to “professional investors” as defined under the Securities and Futures Ordinance of Hong Kong (Cap 571). The contents of this document have not been reviewed nor approved by any regulatory authority including the Securities and Futures Commission in Hong Kong. Accordingly, save where an exemption is available under the relevant law, this document shall not be issued, circulated, distributed, directed at, or made available to, the public in Hong Kong.
Singapore: This material is disseminated in Singapore by Morgan Stanley Investment Management Company, Registration No. 199002743C. This material should not be considered to be the subject of an invitation for subscription or purchase, whether directly or indirectly, to the public or any member of the public in Singapore other than (i) to an institutional investor under section 304 of the Securities and Futures Act, Chapter 289 of Singapore (“SFA”), (ii) to a “relevant person” (which includes an accredited investor) pursuant to section 305 of the SFA, and such distribution is in accordance with the conditions specified in section 305 of the SFA; or (iii) otherwise pursuant to, and in accordance with the conditions of, any other applicable provision of the SFA. This material has not been reviewed by the Monetary Authority of Singapore.
Australia: This material is provided by Morgan Stanley Investment Management (Australia) Pty Ltd ABN 22122040037, AFSL No. 314182 and its affiliates and does not constitute an offer of interests. Morgan Stanley Investment Management (Australia) Pty Limited arranges for MSIM affiliates to provide financial services to Australian wholesale clients. This material will not be lodged with the Australian Securities and Investments Commission.
Japan: For professional investors, this material is circulated or distributed solely for informational purposes. For non-professional investors, this material is provided in connection with Morgan Stanley Investment Management (Japan) Co., Ltd. (“MSIMJ”)’s business with respect to discretionary investment management agreements (“IMA”) and investment advisory agreements (“IAA”). This does not constitute a recommendation or solicitation of transactions nor offers any particular financial instruments. Under an IMA, with respect to the management of client assets, the client prescribes basic management policies in advance and commissions MSIMJ to make all investment decisions based on an analysis of the value, etc. of the securities, and MSIMJ accepts such commission. The client shall delegate to MSIMJ the authorities necessary to make such investment decisions. MSIMJ exercises these delegated authorities accordingly, and the client shall not make individual instructions. All investment profits and losses belong to the clients; principal is not guaranteed. Please consider the investment objectives and nature of risks before investing. As an investment advisory fee for an IAA or an IMA, the amount of assets subject to the contract multiplied by a certain rate (the upper limit is 2.20% per annum (including tax)) shall be incurred in proportion to the contract period. For some strategies, a contingency fee may be incurred in addition to the fee mentioned above. Indirect charges also may be incurred, such as brokerage commissions for underlying securities. Since these charges and expenses vary by contract and other factors, MSIMJ cannot present the rates, upper limits, etc. in advance. All clients should read thoroughly the Documents Provided Prior to the Conclusion of a Contract carefully before executing an agreement. This material is distributed in Japan by MSIMJ, Registered No. 410 (Director of Kanto Regional Finance Bureau (Financial Instruments Firms)), Membership: the Japan Securities Dealers Association, the Investment Management Association of Japan and the Type II Financial Instruments Firms Association.
This image indicates content designed specifically for Financial Advisors / Investment Professionals. This material is not to be used with the public.