American Water Works Company, Inc.

Item 8.01. Other Events. Discovery of and Response to Cybersecurity Incident On October 3, 2024, American Water Works Company, Inc. (the “Company”) learned of unauthorized activity within its computer networks and systems, which the Company determined to be the result of a cybersecurity incident. Upon learning of this activity, the Company immediately activated its incident response protocols and third-party cybersecurity experts to assist with containment and mitigation activities and to investigate the nature and scope of the incident. The Company also promptly notified law enforcement and is coordinating fully with them. The Company has taken and will continue to take steps to protect its systems and data, including disconnecting or deactivating certain of its systems. The Company currently believes that none of its water or wastewater facilities or operations have been negatively impacted by this incident. Although the Company is currently unable to predict the full impact of this incident, the Company does not expect the incident will have a material effect on the Company, or its financial condition or results of operations. Cautionary Statement Concerning Forward-Looking Statements Certain statements included in this Current Report on Form 8-K are forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, Section 21E of the Securities Exchange Act of 1934, and the Private Securities Litigation Reform Act of 1995. In some cases, these forward-looking statements can be identified by words with prospective meanings such as “intend,” “plan,” “estimate,” “believe,” “anticipate,” “expect,” “predict,” “project,” “propose,” “assume,” “forecast,” “outlook,” “future,” “pending,” “goal,” “objective,” “potential,” “continue,” “seek to,” “may,”