Hackers attempted to poison water supply in small Florida town near site of Super Bowl

While Americans are assured electoral processing programs are not being hacked, apparently programs managing our water supplies are a different story.

Hackers broke into the computer software of a water treatment facility near Tampa, Florida — site of Super Bowl LV — on Friday and allegedly tried to poison the water supply by remotely adding a dangerous level of the additive sodium hydroxide.

Thankfully, the attempt was thwarted in the town of Oldsmar, which supplies water to about 15,000 people, according to Reuters.

Pinellas County Sheriff Bob Gualtieri said at a Monday news conference that the hackers gained access to the computer system at the public-owned facility, allowing them to control other systems — the remote-access software TeamViewer was installed at the Oldsmar plant.


(Source: Pinellas Sheriff/YouTube)

“Public drinking water systems — like other public utility systems — are part of the nation’s critical infrastructure and can be vulnerable targets when someone desires to adversely affect public safety,” Gualtieri said.

“The guy was sitting there monitoring the computer as he’s supposed to and all of a sudden he sees a window pop up that the computer has been accessed,” he said. “The next thing you know someone is dragging the mouse and clicking around and opening programs and manipulating the system.”

Once in the program, the hackers reportedly increased the amount of sodium hydroxide being added to the water supply, Gualtieri said. Also known as lye, the chemical is safe at the small levels used to control the acidity of water, but is dangerous at higher levels.

The plant employee was fortunately paying attention and quickly alerted superiors, who then called police. The employee immediately reversed the command and the sheriff said “the public was never in danger.”

“The amount of sodium hydroxide that got in was minimal and was reversed quickly,” Gualtieri said.

A criminal investigation was launched, he added, with assistance from the FBI and the Secret Service. It is not clear whether the attack originated within the United States or from another country.

Oldsmar Mayor Eric Seidel said at the news conference that the water treatment facility had other controls in place to prevent dangerous levels of the chemical being added to the water supply unnoticed.

“The important thing is to put everyone on notice and I think that’s really the purpose of today is to make sure that everyone realizes that these bad actors are out there,” he added.

Sheriff Gualtieri said of the failed attempt to poison the town’s water supply, “This is dangerous stuff.”

“This is somebody that is trying, it appears on the surface, to do some something bad,” he said.

There are no suspects as of yet, but investigators reportedly have some leads they are pursuing.

The sheriff said he was unsure why hackers would target the town of Oldsmar, but urged other local municipalities to review their computer security protocols in place at water treatment facilities and other infrastructure.

Lesley Carhart, a principal threat analyst at industrial control system security firm Dragos, told Wired that water treatment and sewage plants are frequently some of the most digitally vulnerable critical infrastructure targets in the U.S.

She explained that some municipal water treatment plants have one lone IT person, and often face budget cuts. Remote work scenarios imposed by the COVID pandemic add to the problem.

“They’re doing whatever they have to to keep water flowing and sewage treated,” Carhart said. “If they don’t have the resources to do that and do cybersecurity, what are they going to do? They’re going to keep the process running, keep society running. That’s what they have to do.”

Powered by Topple

Tom Tillison

Comments

Latest Articles