The Florida city of Oldsmar was on alert Monday after authorities revealed that someone — it’s not at present clear who — remotely accessed the local water treatment plant and attempted to dump dangerous amounts of chemicals into the water supply. According to Pinellas County Sheriff Bob Gualtieri, who detailed the apparent attack in a Monday press conference, the hacker was able to take control of a computer at the facility and subsequently increase the sodium hydroxide (aka lye) levels to a hundred times what they should be.
“The computer system was set up with a software program that allows for remote access, where authorized users can troubleshoot system problems from other locations,” explained Gualtieri.
It was this system, which Reuters reporter Chris Bing confirmed was TeamViewer, which apparently granted the hacker access to the water treatment controls. The hacker changed the sodium hydroxide levels from 100 parts per million to 11,100 parts per million, according to Gualtieri, who also noted that sodium hydroxide is the main ingredient in liquid drain cleaner.
The first intrusion reportedly took place around 8 a.m. local time on Friday morning, and the second one — where the changing of the lye levels happened — went down later that day around 1:30 p.m. Thankfully, according to Gualtieri, a plant operator saw the computer mouse moving, and undid the changes before any damage could be done.
“The public was never in danger,” Gualtieri explained. “Right now we do not have a suspect identified, but we do have leads that we’re following.”
In 2013, Wired reported that many industrial control systems — and even hydroelectric plants — were left open to outsiders via the internet. This is an ongoing problem. In 2017, security researchers discovered that some ships’ satellite antenna systems were likewise exposed to the internet.
“The important thing is to put everyone on notice,” Oldsmar Mayor Eric Seidel said at the press conference.
Consider yourself warned.