According to officials from Pinellas County, Florida, on Monday, a cyber-hacker was able to gain control of the City of Oldsmar’s water treatment system and attempted to increase the concentration of sodium hydroxide, also known as lye, effectively poisoning the water supply.
Pinellas County Sheriff Bob Gualtieri reported that a plant operator noticed the hacker’s attempt and reversed the effects. Though the hacker first gained access to the system at 8 a.m. Friday, an attempt noted by the operator, the hacker actually attempted to change the sodium hydroxide levels at 1:30 p.m. that day.
“The intruder exited the system, and the plant operator immediately reduced the level back to the appropriate amount of one hundred,” Gualtieri said. “The hacker changed the sodium hydroxide from about one hundred parts per million to 11,100 parts per million.” These levels of sodium hydroxide were characterized as “dangerous” by the sheriff.
“Why it is someone hacked into the system not just once but twice … opened the program and changed the levels from 100 to 11,100 parts per million with a caustic substance. So, you label it however you want, those are the facts,” Gualtieri said, in response to a question of whether or not this instance would be labeled as bioterrorism.
The water treatment system includes a remote access component, which the hacker capitalized on, so that “authorized users could troubleshoot system problems from other locations,” according to Gualtieri, who said that going forward he plans to “stop further remote access to the system.”
During the press conference, Gualtieri commented on the nature of the hacker’s attempt: “The person who remotely accessed the system for about three to five minutes, opening various functions on the screen. One of the functions opened by the person hacking into the system was one that controls the amount of sodium hydroxide in the water.”
A criminal investigation, involving Country officials, the FBI and the Secret Service, has been launched.
