The Oldsmar water 'hack': a poisoning scare that may not have been an attack

In February 2021 a small Florida city became the face of a national fear: a hacker who reached into a water plant and tried to poison the supply with lye. Two years later, the city's former top administrator said there had been no hacker at all.^[1] This case file covers what was reported, what changed, why the plant looked so easy to break into either way, and the control that was weak.

What happened

How it worked, or seemed to

Whatever caused the change, the investigation exposed how the plant's computers were set up. Reporting at the time said the control system ran on computers using Windows 7, which Microsoft had stopped supporting, and that the computers shared a single password for the remote access software staff used to log in from outside. There was no firewall between those machines and the internet.^[3]

In plain terms, anyone who learned one password could have reached the controls for the city's water, and nobody could tell afterward which person had used it. Days before the incident, a batch of leaked email addresses and passwords tied to Oldsmar had also surfaced online, though no link to the plant was confirmed.^[1]

How the story changed

In April 2023 the former Oldsmar city manager told a virtual conference of public administrators that the FBI had found no evidence of outside access, and that the likely cause was the same employee who had been praised for catching it, pressing keys by mistake.^[1] The FBI said that through its investigation it was not able to confirm that the incident began with a targeted cyber intrusion.^[1]

No one was ever charged. The honest summary is that nobody has proved a hacker did it, and nobody has proved one did not.

What it cost

No one was hurt, because the setting was reversed before it could take effect.^[1] The real cost was trust and attention. For 2 years the incident was treated as a textbook attack on a water system, even though its basic facts were never settled.^[1] The FBI and other agencies used it to urge utilities to move off unsupported software and to stop sharing remote access passwords.^[4]

The missing control

The missing control: unique, individual credentials for remote access, with a record of who used them. The plant's computers shared one password for remote login.^[3]

That weakness mattered both ways. If an outsider did get in, one shared password meant a single leak exposed everything. And if no one did, the plant still could not quickly prove it, because a shared login leaves no clear trail of which person made which change. Individual accounts with their own passwords and a second login check would have made an outside break-in harder and turned a 2-year mystery into a question answerable in an afternoon.

What to do in your business

• Give everyone their own login. Stop using shared accounts for remote access, payroll, banking or point-of-sale systems, so every action ties back to one person.
• Add a second check to remote access. Require a code or app approval on any tool that lets people log in from outside the building.
• Keep logs you can read. Make sure remote access tools record who connected, when and from where, and know how to pull that record before you need it.
• Retire unsupported computers. Replace or isolate any machine running an operating system that no longer gets security updates, especially one that controls equipment or money.
• Put a firewall in front. Do not connect control systems, cameras or registers straight to the internet; ask your IT provider to put them behind a firewall and allow only the connections you need.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.