Stolen passwords are exposing America’s water providers to hackers

Recent security research has uncovered that more than a thousand U.S. water and wastewater providers are vulnerable to hacking due to malware designed to steal their employees' passwords and active logged-in sessions. Cybersecurity firm SpyCloud's findings highlight how water providers and other critical infrastructure can be compromised easily amidst a wave of hacks targeting water supplies across the United States.

While malware stealing passwords isn't new, this research underscores the ease with which hackers can exploit stolen passwords to breach an organization's network without relying on AI tools. SpyCloud compiled a database of over 66,000 public-facing systems registered with the U.S. Environmental Protection Agency, representing 10,000 organizations.

The firm discovered that malware had stolen passwords and credentials from 1,787 organizations, nearly 20% of the providers they examined. At least 250 organizations had exposed credentials that granted access to their operational networks and remote-access systems, which control physical pumps and water flows. The analysis included an unnamed metering tech provider whose network was infected with password-stealing malware, which stole credentials, including passwords for 167 U.S. utility companies that depend on the metering tech provider.

SpyCloud's Chief Investigations Officer, Jason Lancaster, explained that a single breach could provide criminals access to "a hundred otherwise unrelated organizations." Password-stealing malware, also known as infostealers, enables hackers to steal a person's stored passwords and the session tokens that keep them logged in, potentially bypassing multi-factor authentication systems.

Cybercriminals frequently trade stolen credentials to gain access to specific organizations. This research follows a series of hacks targeting water providers across the United States, which the U.S. government has privately attributed to Iran-backed hackers. SpyCloud revealed no evidence that these Iran-linked hacks relied on stolen passwords, suggesting that security weaknesses, such as manufacturer-set default passwords, in mechanical switches and physical controllers used by critical infrastructure may be more likely culprits, as reported by earlier findings from the U.S. cybersecurity agency CISA.

SpyCloud emphasizes that stolen passwords are a significant source of access for anyone seeking to exploit critical infrastructure technology. Lancaster noted that the water sector must address both the risks associated with stolen passwords and the security vulnerabilities in critical infrastructure tech.