To respond to growing concerns related to potential contamination ingress via backflow and/or terrorist threats to drinking water, a data mining approach is developed. Use of this data mining approach, in conjunction with a maximum likelihood procedure provides the means to identify the location and time of an intrusion event, based on limited sensor data. Uncertainties in water demand, sensor measurement, and modeling, are demonstrated to be highly relevant and necessary to be considered in the contamination identification problem. The effectiveness of the data mining method is demonstrated using a case study network where it takes only 3 min to identify a multiple injection event using five sensors in a 285 node water distribution network, including consideration of the aforementioned sources of uncertainty. The effectiveness of the method ensures the ability for a rapid-response to an abnormal event, and consequently, minimizes exposure risks of water consumers.