The Lights Were Already On

In February 2021, someone remotely accessed the water treatment system serving Oldsmar, Florida and increased the sodium hydroxide concentration in the drinking water supply from 111 parts per million to 11,100 parts per million. Sodium hydroxide is lye. At that concentration, it would have caused severe chemical burns to anyone who drank the water. Oldsmar's system serves 15,000 people.

The attacker got in through TeamViewer, a remote access tool installed on the plant's computers so supervisors could troubleshoot systems from offsite. It is the kind of software millions of businesses use every day.

The cursor moved twice. The first time, at 8 AM, the operator watched it move across his screen and assumed it was his supervisor accessing the system remotely. He thought nothing of it. At 1:30 PM it moved again, this time navigating directly to the chemical controls, opening the interface, and entering the new value. He reversed it within seconds. There is no protocol that requires anyone to be watching that screen at any given moment. He was watching by chance. Both times.

The incident occurred on Friday, February 5th. It was not publicly disclosed until a press conference on Monday, February 8th. In the days between, 15,000 people drank the water.

Nobody knows if it was the first time someone got in.