In February 2021, an attacker at the Oldsmar, Florida water treatment plant remotely accessed the system’s HMI via TeamViewer and briefly boosted sodium hydroxide levels from 100 parts per million to 11,100 ppm a jump that could have turned the water supply into a caustic hazard. A plant operator spotted the cursor moving on screen and reversed the change before anyone was harmed. The attack was trivial: a shared password, an internet-exposed remote access tool, and no multi-factor authentication.
Oldsmar wasn’t a one-off. Across the U.S., municipal water utilities rely on industrial control systems (ICS) and SCADA networks that were designed decades ago for reliability, not security. Many of these systems run on legacy firmware, communicate over protocols with no authentication, and are increasingly connected to the internet for convenience. The result: a critical infrastructure sector that is uniquely vulnerable to cyberattacks, with consequences that could threaten public health.
The Anatomy of a Water Utility’s Control System
To understand the vulnerabilities, you need to know the hardware. Municipal water systems use Supervisory Control and Data Acquisition (SCADA) systems to monitor and control everything from water treatment to distribution. The key components are Programmable Logic Controllers (PLCs) and Remote Terminal Units (RTUs)—small, specialized computers that open and close valves, start and stop pumps, and read sensors for pressure, flow, chlorine levels, and water levels.
These devices are the workhorses of the water system. They run on firmware that often hasn’t been updated in years, and they communicate over protocols like Modbus and DNP3 that were designed in an era when no one imagined they’d be connected to the internet. These protocols have zero authentication and no encryption. Anyone who can reach the network can send commands as if they were the operator.
In the past, that was okay because these systems were air-gapped—physically isolated from other networks. But that’s eroded. Utilities now connect their OT networks to IT networks for remote monitoring, billing, and compliance. The air gap has become a porous membrane, and attackers have found the holes.
How Attackers Get In
Attackers use a variety of vectors to breach water utilities, and many of them are embarrassingly simple.
Internet-exposed devices. Shodan, a search engine for internet-connected devices, routinely shows HMIs and PLCs accessible to anyone. Many have default credentials like “admin/admin” or no password at all. In one 2023 incident reported by CISA, an attacker changed a pump’s operational parameters after finding the HMI exposed online.
Phishing and lateral movement. A classic approach: phish an employee in the IT department, get a foothold in the corporate network, then pivot to the OT network. The 2015 Ukraine power grid attack used this technique, and water utilities share similar architectures.
VPN and remote access vulnerabilities. Utilities often use VPNs for remote access, but these appliances may be unpatched. In 2021, a ransomware group hit a water treatment plant in California by exploiting a known vulnerability in a VPN appliance.
Supply chain and third-party access. Vendors and contractors often have standing remote access to multiple utilities. If an attacker compromises a vendor, they can reach any utility that trusts that vendor’s credentials. This is a single point of failure that affects many small utilities.
Physical access. USB drops, direct connection to serial ports, or engineering workstations left unsecured. It’s not glamorous, but it works.
Water-specific protocol attacks. Attackers can inject false sensor readings—telling the system a tank is full when it’s empty—or send direct commands to valves and pumps. The Oldsmar attack was a direct command to increase lye dosage.
Real-World Incidents: From Sewage to Lye
The threat isn’t theoretical. Here are some notable cases:
- Oldsmar, Florida (2021): As described, an attacker used TeamViewer to access the HMI and tried to poison the water supply. It was stopped by a sharp-eyed operator.
- Maroochy Shire, Australia (2000): A disgruntled former contractor used radio equipment and stolen software to release 800,000 liters of raw sewage into waterways over three months. This is the classic insider attack.
- Ukraine (2015/2016): Though primarily power grids, the BlackEnergy and Industroyer malware demonstrated how OT systems can be remotely manipulated. Water utilities run on similar architectures.
- Israel (2020): State actors attempted attacks on water infrastructure, targeting chlorine dosing and other control systems.
- Multiple U.S. incidents (2023–2024): CISA reported intrusions at water facilities via internet-exposed HMIs and default passwords, including one where an attacker changed a pump’s operational parameters.
These incidents show a range of attackers—from disgruntled insiders to nation-states—and a common theme: the systems are vulnerable because they were never designed with security in mind.
Why Water Utilities Are Uniquely Vulnerable
There are about 150,000 public water systems in the U.S. alone. The vast majority serve small populations with tiny IT budgets and no dedicated security staff. A town of 2,000 people doesn’t have a CISO.
Legacy infrastructure is another factor. Pumps and pipes can last 50 years, and the control systems are often just as old. It’s not uncommon to find Windows XP machines running a treatment plant’s SCADA system. These unsupported operating systems are riddled with known vulnerabilities that will never be patched.
Safety vs. security trade-offs are baked into the design. Water systems are engineered for reliability and fail-safe operation. If a sensor fails, the system should default to a safe state. But that also means availability trumps confidentiality and integrity. Attackers can exploit this by forcing the system into unsafe states.
The human factor is huge. Operators often share passwords, use default credentials, and leave remote access tools like TeamViewer and AnyDesk installed for vendor convenience. Vendors may have standing access to dozens of utilities, creating a single point of compromise. Turnover and lack of documentation mean accounts are rarely deactivated when employees leave.
Cost constraints make it hard to fix these problems. Small utilities can’t afford modern SCADA upgrades, network segmentation, or 24/7 monitoring. The result is a sector that is underfunded, understaffed, and under attack.
The Threat Landscape: Who’s Attacking and Why
The attackers range from nation-state actors to cybercriminals. Nation-states target water infrastructure for espionage, disruption, or retaliation. Israel’s 2020 attacks were attributed to state actors. Cybercriminals have also hit water utilities with ransomware—in 2021, a ransomware attack on a California water facility forced operators to switch to manual control.
These attacks can have real consequences. An attacker who manipulates chlorine levels could cause a public health crisis. One who opens a valve could flood a town. The potential for physical harm distinguishes water utilities from typical data breaches.
The Regulatory Landscape: Gaps and Progress
In the U.S., CISA and the EPA oversee water sector cybersecurity. The America’s Water Infrastructure Act (AWIA) requires utilities to conduct risk assessments and prepare emergency response plans, but it doesn’t mandate cybersecurity standards. Many incidents go unreported—utilities fear reputational damage or fines.
CISA has issued emergency directives requiring action for known exploited vulnerabilities, and the Biden administration has proposed cybersecurity requirements for public water systems. The EPA has even taken enforcement actions against non-compliant utilities. But progress is slow, and the gap between large and small utilities remains wide.
What Can Be Done
The fixes are known but require investment and political will. Network segmentation can isolate OT networks from IT networks. Multi-factor authentication would have stopped Oldsmar. Regular patching of known vulnerabilities closes the most common attack paths. And training operators to recognize phishing attempts could prevent initial compromise.
But for the thousands of small utilities, these solutions may seem out of reach. That’s where federal assistance and sector-wide initiatives come in. The threat is real, and the time to act is now—before an attack succeeds.
Municipal water systems are critical infrastructure, yet they remain dangerously exposed. The technology is old, the budgets are thin, and the attackers are sophisticated. But the fixes are known: segment networks, require multi-factor authentication, patch vulnerabilities, and train staff. The next Oldsmar might not have a quick-thinking operator to stop it.
Summary
- Municipal water systems rely on legacy SCADA and ICS systems that lack modern security features.
- Attack vectors include internet-exposed devices, phishing, VPN exploits, and third-party access.
- Real-world incidents like Oldsmar, Florida and Maroochy Shire show the potential for physical harm.
- Fragmented ownership, legacy infrastructure, and cost constraints make utilities uniquely vulnerable.
- Regulatory gaps persist, but CISA and EPA are taking steps to enforce better security.
FAQ
Q: What is SCADA and why is it used in water systems?
A: SCADA (Supervisory Control and Data Acquisition) systems monitor and control water treatment, storage, and distribution. They use PLCs and RTUs to automate valves, pumps, and sensors.
Q: How did the Oldsmar attack happen?
A: The attacker accessed the plant’s HMI via TeamViewer using a shared password and increased sodium hydroxide levels. An operator spotted it and reversed it.
Q: Why are water utilities so vulnerable?
A: They have legacy equipment, lack cybersecurity budgets, and often rely on default credentials and unpatched systems. The OT networks are increasingly connected to IT networks, creating attack paths.
Q: What can a hacker do to a water system?
A: They can change chemical dosing, manipulate valve positions, or disrupt pumps, potentially causing contamination, flooding, or service outages.
Q: Is there regulation for water system cybersecurity?
A: The America’s Water Infrastructure Act requires risk assessments, but mandatory cybersecurity standards are still being developed. CISA and EPA are increasing oversight.
