Hacker broke into Florida water treatment plant and attempted to increase amount of chemical found in drain cleaner to 'dangerous' levels
Hackers broke into a water treatment facility that serves the town of Oldsmar in Florida on Friday and attempted to poison the water supply, the Pinellas County Sheriff said on Monday.
The amount of sodium hydroxide, also known as lye, was momentarily increased from 100 parts per million to 11,100 parts per million.
'In these mega quantities, it's a caustic substance,' said Sheriff Bob Gualtieri.
The hackers remotely gained access to a software program, named TeamViewer, on the computer of an employee at the facility to gain control of other systems. Supervisors routinely 'remote in' to the computers, so the employee was not initially worried.
'The guy was sitting there monitoring the computer as he's supposed to and all of a sudden he sees a window pop up that the computer has been accessed,' Gualtieri said.
'The next thing you know someone is dragging the mouse and clicking around and opening programs and manipulating the system.'
The Oldsmar water treatment facility, pictured, was targeted in Friday's hack
Hackers massively increased the amount of sodium hydroxide, also known as lye, in the water
Sheriff Bob Gualtieri (center) is pictured with Mayor Eric Seidel (right) and City Manager Al Braithwaite (left) at a press conference on Monday announcing the foiled hack
The hackers then increased the amount of the chemical being distributed into the water supply.
The chemical is typically used in small amounts to control the acidity of water, but at higher levels is dangerous to consume.
'I'm not a chemist, but it is the primary ingredient in liquid drain cleaners,' said Gualtieri, speaking at a press conference on Monday.
'It's lye.
'I want to stress, it would have been caught.
'But if you want to put that amount of substance in the drinking water, it's not a good thing.'
The plant employee whose computer was hacked at 8am and 1:30pm on Friday noticed the change and alerted his employer, who called the sheriff.
The the water treatment facility was able to quickly revert the command, leading to minimal impact.
Investigators do not yet know why Oldsmar, with a population of 15,000, was targeted
Officials in Oldsmar stressed that the water treated at the facility (pictured) was not harmed
'The amount of sodium hydroxide that got in was minimal and was reversed quickly,' Gualtieri said.
The affected water treatment facility is a public utility owned by the local town, he explained, which has its own internal IT team.
Oldsmar is near the city of Tampa.
The FBI and Secret Service have been called in to assist in an investigation.
Gualtieri said he does not know who is responsible for the cyberattack.
'The important thing is to put everyone on notice,' he said.
'Obviously these investigations are very complicated. We don't know right now if the breach originated within the United States, or outside the country.'
In May investigators in Israel concluded that Iran was linked to an attempted cyberattack aimed at disrupting water supplies in at least two locations in Israel.
The incident, which occurred on April 24 and 25, was quickly detected and thwarted before it could cause damage.
The hackers sought to cripple computers that control water flow and wastewater treatment for a pair of rural districts in Israel, The Washington Post reported at the time.
Gualtieri said that they do not know why Oldsmar was specifically targeted.
Investigators are unsure why Oldsmar was singled out but are warning others to be vigilant
Investigators will likely be asking whether its location, close to Tampa, days before the Super Bowl was held in the city, was a factor.
Al Braithwaite, the City Manager, said they are asking all water treatment facilities to update their systems immediately, to ensure the most up-to-date software and firewalls are installed.
Eric Seidel, mayor of Oldmar, said that the incident was a reminder of the threats faced on a daily basis by infrastructure providers.
'The protocols we have in place - that's the good news. Even if they hadn't caught them, there are redundancies in the system, alarms and so on, that would have caught them,' he said.
But, he added: 'there are bad actors out there.'
