Stolen passwords expose US water providers to hackers, research finds

• Over 1,700 U.S. water and wastewater providers are exposed to hacks due to stolen passwords and active login sessions.
• Cybersecurity firm SpyCloud's research found that password-stealing malware had compromised credentials for 1,787 organizations.
• At least 250 organizations had exposed credentials that appeared to allow access to their operational networks and remote-access systems.
• A single breach at a metering tech provider exposed credentials for 167 U.S. utility companies.
• Stolen session tokens can allow hackers to bypass multi-factor authentication systems.

New research from cybersecurity firm SpyCloud reveals that over 1,700 U.S. water and wastewater providers are vulnerable to cyberattacks due to stolen employee passwords and active login sessions. The findings highlight the ease with which critical infrastructure can be compromised amidst a wave of hacks targeting water supplies across the United States.

SpyCloud built a database of more than 66,000 public-facing systems registered with the U.S. Environmental Protection Agency, identifying 10,000 organizations. Their analysis found that password-stealing malware had compromised credentials for 1,787 of these organizations, representing nearly 20% of those checked. Crucially, at least 250 organizations had credentials exposed that appeared to grant access to their operational networks and remote-access systems, which control physical infrastructure like pumps and water flows.

The research noted that a single breach at an unnamed metering tech provider resulted in the theft of credentials for 167 U.S. utility companies that rely on the provider. SpyCloud chief investigations officer Jason Lancaster stated that this single incident provided criminals with access to "a hundred otherwise unrelated organizations."

Password-stealing malware, also known as infostealers, can steal stored passwords and session tokens, allowing hackers to impersonate legitimate users and often bypass multi-factor authentication. These stolen credentials are frequently traded on illicit markets.

While this research focuses on password-based vulnerabilities, it comes weeks after a series of hacks targeting water providers, which the U.S. government has privately linked to Iran-backed actors. SpyCloud found no evidence that those specific Iran-linked attacks utilized stolen passwords, instead pointing to security weaknesses like default passwords on mechanical switches and physical controllers, consistent with earlier findings from CISA. SpyCloud researchers emphasize that stolen passwords remain a significant and accessible entry point for attackers, a risk that coexists with other known security vulnerabilities in critical infrastructure technology.