Florida County’s Water Supply Nearly Poisoned by Bioterrorist Hacker

A hacker nearly poisoned the entire water supply for Oldsmar, Florida on Friday, and they have still not been identified. Officials from Pinellas County announced the attack in a press conference on Monday, according to a report by Vice. A legitimate operator saw the hacking attempt in time to reverse it, but the attack raises serious questions about public infrastructure security.

The hacker reportedly took remote control of the water treatment system for Oldsmar through a computer and tried to drastically increase the amount of sodium hydroxide in the water supply. Sodium hydroxide, also known as lye, can be deadly if ingested in large amounts, and otherwise harmful. Pinellas County Sheriff Bob Gualtieri held a press conference on Monday, assuring residents that an operator caught the change in time. However, the hacker has not been identified.

“The hacker changed the sodium hydroxide from about one hundred parts per million to 11,100 parts per million,” Gualtieri said. Asked whether the term “bioterrorism” applies here, he said: “What it is is someone hacked into the system not just once but twice … opened the program and changed the levels from 100 to 11,100 parts per million with a caustic substance. So, you label it however you want, those are the facts.”

Gualtieri did not share everything in his press conference since this is an ongoing investigation but hinted that sodium hydroxide may not have been the hacker’s only goal. He said: “The person who remotely accessed the system for about three to five minutes, opening various functions on the screen. One of the functions opened by the person hacking into the system was one that controls the amount of sodium hydroxide in the water.”

Gualtieri explained that the water treatment system for Oldsmar is set up for remote access intentionally, so that “authorized users could troubleshoot system problems from other locations.” After the cyberattack, he said that operators took steps to “stop further remote access to the system.” He added that there are other safeguards in place which hopefully could have stopped this mass poisoning from happening.

Had the amount of lye in the water supply been changed even slightly, the consequences could have been dire. Lye can cause severe burns to the skin and long-term damage to the eyes, meaning anyone bathing at the time would have been affected. Some cities allow small amounts of lye in the water just to prevent corrosion of pipes and to raise the pH levels of the water.

The FBI and the Secret service have both joined in the County Sheriff’s criminal investigation into this attack. In the meantime, it is raising concerns about cybersecurity all over the country.