Cyber Attack Attempts to Poison Entire Town

Note: Incident shows the vulnerabilities of water infrastructure. 

A mystery group of hackers seized control of a US town’s water supply and began leaking dangerous chemicals in a frightening cyber attack.  Officials said they don’t know who broke into the computer system but the poisoning was thwarted and only a ‘minimal’ amount of the harmful substance got in.  Pinellas County Sheriff said that hackers targeted the computer system of a facility that treats water for about 15,000 people near Tampa, Florida.  

The cyber criminals sought to add a dangerous level of additive to the water supply on Friday by gaining remote access to a software program called TeamViewer.  The attack was noticed by an employee at the facility for the town of Oldsmar.  Sheriff Bob Gualtieri said: “The guy was sitting there monitoring the computer as he’s supposed to and all of a sudden he sees a window pop up that the computer has been accessed.

“The next thing you know someone is dragging the mouse and clicking around and opening programs and manipulating the system.”  The hackers then increased the amount of sodium hydroxide, also known as lye, being distributed into the water supply.  The chemical is typically used in small amounts to control the acidity of water, but at higher levels is dangerous to consume.  The plant employee alerted his employer, who called the sheriff and the water treatment facility was able to quickly reverse the command, leading to ‘minimal impact.’  

Oldsmar Mayor Eric Seidel said in a press conference on Monday that the affected water treatment facility also had other controls in place that would have prevented a dangerous amount of lye from entering the water supply unnoticed.  Sheriff Gualtieri added: “The amount of sodium hydroxide that got in was minimal and was reversed quickly.”

US Senator for Florida, Marco Rubio, also responded to the attack and said via Twitter : “I will be asking the FBI to provide all assistance necessary in investigating an attempt to poison the water supply of a Florida city.  “This should be treated as a matter of national security.”

The treatment facility is a public utility owned by the town which has its own internal IT team.  Oldsmar is about 17 miles northwest of Tampa and has about 15,000 residents.

TeamViewer, which says on its website that its software has been installed on 2.5 billion devices worldwide, enables remote technical support among other applications.

The FBI and Secret Service are reportedly helping investigators but Sheriff Gualtieri said he does not know who is responsible for the cyberattack.  He added: “The important thing is to put everyone on notice. This should be a wake-up call.”

Originally published in the Daily Mirror