From TechCrunch · Zack Whittaker · · 1m 20s
Stolen passwords are exposing America's water providers to hackers
Over a thousand U.S. water utilities are vulnerable to hacks through stolen employee passwords and login sessions.
In brief
Over a thousand U.S. water utilities are vulnerable to hacks through stolen employee passwords and login sessions. Water providers face two separate security threats: stolen credentials that hackers can easily exploit, and outdated equipment with default passwords that Iran-backed groups have already targeted…
Over 1,700 water providers compromised
SpyCloud found that password-stealing malware has exposed credentials from 1,787 U.S. water and wastewater providers, nearly one in five of the 10,000 organizations checked.
Stolen passwords bypass security
Password-stealing malware, called infostealers, captures stored passwords and session tokens that let hackers log in as legitimate users, often bypassing multi-factor authentication.
One breach exposed 167 utilities
A single infected metering device stole credentials for 167 U.S. utility companies, giving hackers access to a hundred otherwise unrelated organizations through one compromise.
“a hundred otherwise unrelated organizations”
250 providers at operational risk
At least 250 water providers had exposed credentials that could grant access to operational networks and remote-access systems controlling physical pumps and water flows.
Two separate attack methods
Recent Iran-backed hacks exploited default passwords in equipment, while stolen credentials represent a parallel threat that hackers can easily purchase or trade on the dark web.
Water sector faces dual threats
Water providers must address both stolen passwords circulating among criminals and outdated equipment with weak default security, creating overlapping vulnerabilities.
“has to hold both stories at once”
What to remember
Water providers face two separate security threats: stolen credentials that hackers can easily exploit, and outdated equipment with default passwords that Iran-backed groups have already targeted.
