Stolen Passwords Expose U.S. Water Providers to Cybersecurity Risks
New research from cybersecurity firm SpyCloud reveals that over a thousand water and wastewater providers in the United States are at risk of cyberattacks due to password-stealing malware. The study found that nearly two out of ten organizations had their employees' credentials compromised, with some providing access to critical operational systems like pumps and flow controls. The findings highlight how easily hackers can infiltrate infrastructure networks using stolen passwords or session tokens—often bypassing multi-factor authentication. A single infected device at a metering tech provider led to the exposure of 167 utility companies' credentials, demonstrating the cascading impact such breaches can have across unrelated organizations. This comes amid recent cyberattacks on U.S. water systems linked to Iran-backed hackers, though those incidents were attributed to default passwords in physical infrastructure rather than stolen login data. SpyCloud's research underscores a growing concern for cybersecurity vulnerabilities within critical sectors.
Topics: cybersecurity malware password theft water infrastructure