In an event that should put the country’s Department of Homeland Security on notice, a hacker gained access to one Florida city’s water treatment utility command systems and increased the level of sodium hydroxide to dangerous and harmful levels.
During a press conference Monday, Pinellas County, Florida Sheriff Bob Gualtieri said his department was engaged in an investigation of the hack, along with the FBI and US Secret Service.
The joint investigative effort is investigating both how the breach came to be and whether it came from within the United States or from a foreign or foreign-based actor.
According to Gualtieri, there were two breaches of the system. The first incident first occurred on February 5th at the city’s water treatment plant when. Around 8am EDT, an operator noticed a remote access to the computer system he was monitoring. This particular system is responsible for controlling the accurate mixture of chemicals for drinking water and other operations of the water treatment plant.
This initial breach didn’t cause a great amount of concern because supervisors often use the remote access software to troubleshoot the system from different locations.
It was the second hack that raised concerns and red flags. During the second breach, Gualtieri said, the hacker, spending no more than five minutes accessing the system, adjusted the amount of sodium hydroxide in the drinking water from 100 parts per million to 11,100.
Sodium hydroxide is the chemical name for lye. “This is obviously a significant and potentially dangerous increase. Sodium hydroxide, also known as lye, is the main ingredient in liquid drain cleaners,” Gualtieri said.
Cyberattack on Florida City’s Water Supply
The city of Oldsmar, Florida was the source of disturbing news this week, among reports that someone gained unauthorized access to a water treatment facility. In an era where more systems than ever are connecte… https://t.co/17aM2Ept69
— hackaday (@hackaday) February 9, 2021
The alert operator immediately to action to reduce the levels back to the appropriate mixture. “At no time was there a significant adverse effect on the water being treated,” Gualtieri insisted.
Oldsmar City Manager, Al Braithwaite, noted that even if the operator wouldn’t have detected the malicious tampering, several fail-safes and alarm systems would have detected the spike in the sodium hydroxide levels and automatically initiated safety measures.
Gualtieri reinforced that at no time was the public in danger. “The important thing is to put everyone on notice, and I think that’s really the purpose of today, is to make sure that everyone realizes that these bad actors are out there,” Oldsmar Mayor Eric Seidel said.