Hacker Tries to Poison Florida Town's Water Supply Through Computer Breach

By Joshua Summers First Posted: Feb 10, 2021 06:05 AM EST

A hacker tried to poison the water supply in a Florida community that serves 15,000 people, officials said

(Photo : Mario Tama)
Water flows in an irrigation ditch next to a farm in California's 10th congressional district on October 24, 2018 in Modesto, California.

Officials in Florida on Monday said a hacker tried to poison the water supply in a community that serves 15,000 people. States and cities monitor the water supply consumed by their constituents, just like in Florida. The advancement in technology made watching the water system more accessible, but it also grants hackers a chance to do unusual things.

In a report by Business Insider, the Federal Bureau of Investigation (FBI), U.S. Secret Service, along with the local authorities, probe the source of a recent cyberattack that targeted the water supply in a town outside Tampa.

E&E News shared that the unsuccessful cyberattack on Friday targeted the plant situated in Pinellas County and was marked as the first documented attempt in hacking and contaminating a United States community water supply.

How Did the Hack on Florida's Municipal Water Supply System Happen?

The Christian Science Monitor reported that the hacker, who was able to break the water treatment system in Oldsmar by utilizing a remote access program shared among plant workers, attempted to increase the sodium hydroxide content from 100 to 11,100 parts per million - an 11,000 percent increase.

According to Chemical Safety Facts, the said chemical is utilized to manufacture many everyday products like paper, aluminum, commercial drain, oven cleaners, and even soap, soap, and detergents. In water treatment, sodium hydroxide controls the acidity and removes heavy metals from the water. The chemical is also used to produce sodium hypochlorite, which is a water disinfectant.

In an interview with Insider, Pinellas County Sheriff Bob Gualtieri said an Oldsmar water facility operator initially noticed someone remotely accessing a part of the water treatment system in the morning. He noted that this was not surprising since supervisors sometimes troubleshoot problems from remote locations.

But the operator noticed that the system was once again being accessed remotely past 1 p.m., and this time, the operator saw the hacker open the water treatment software and increase the sodium hydroxide levels in the system.

Gualtieri said the operator immediately reverted the levels back to normal and "at no time" was there danger to the public.

E&E News reported that the recent incident raised concern among experts, saying digitizing the so-called operational technology (OT) that allows the water to flow and electricity running can increases ways for hackers to infiltrate the system.

Experts added that municipal water and other systems are hackers' potential targets since local governments' computer infrastructure tends to be underfunded and lack the cybersecurity depth of power grid and nuclear plants.

What if the Attack on the Water Treatment Facility Had Not Been Noticed?

According to Agency for Toxic Substances and Diseases Registry, sodium hydroxide is extremely corrosive and irritating, which can cause severe burns and permanent damage to any tissue that it has contracted. It adds that this chemical may also cause permanent eye damage since it can burn the eyes and cause hydrolysis.

If the attack had not been noticed by personnel, Gualtieri said it would take 24 to 36 hours for the changes to fully take effect. But the sheriff, mayor, and city manager stressed that there are protocols in place that would have prevented a catastrophe as the system would catch the change in the pH level.

The officials added that they have already disabled the remote-access system to ensure a breach like this would not happen again. As of Monday, Insider reported that investigators have yet to identify the hacker and did not know if the attack originated in the U.S.