# Stolen passwords are exposing America's water providers to hackers

> Over a thousand U.S. water utilities are vulnerable to hacks through stolen employee passwords and login sessions.
- Title: Stolen passwords are exposing America's water providers to…
- Summary: Over a thousand U.S. water utilities are vulnerable to hacks through stolen employee passwords and login sessions. Water providers face two separate security…
- Keywords: water providers, cybersecurity, stolen passwords, infostealers, malware, critical infrastructure, spycloud, epa, iran-backed hackers, session tokens, multi-factor authentication, default passwords
- Source: TechCrunch — https://techcrunch.com/2026/09/22/stolen-passwords-are-exposing-americas-water-providers-to-hackers
- Author: Zack Whittaker
- Published: 2026-09-22T15:50:58+00:00
- Read time: 1 min
- Topics: water providers, cybersecurity, stolen passwords, infostealers, malware, critical infrastructure, spycloud, epa, iran-backed hackers, session tokens, multi-factor authentication, default passwords
## Over 1,700 water providers compromised
SpyCloud found that password-stealing malware has exposed credentials from 1,787 U.S. water and wastewater providers, nearly one in five of the 10,000 organizations checked.
## Stolen passwords bypass security
Password-stealing malware, called infostealers, captures stored passwords and session tokens that let hackers log in as legitimate users, often bypassing multi-factor authentication.
## One breach exposed 167 utilities
A single infected metering device stole credentials for 167 U.S. utility companies, giving hackers access to a hundred otherwise unrelated organizations through one compromise.

> a hundred otherwise unrelated organizations
## 250 providers at operational risk
At least 250 water providers had exposed credentials that could grant access to operational networks and remote-access systems controlling physical pumps and water flows.
## Two separate attack methods
Recent Iran-backed hacks exploited default passwords in equipment, while stolen credentials represent a parallel threat that hackers can easily purchase or trade on the dark web.
## Water sector faces dual threats
Water providers must address both stolen passwords circulating among criminals and outdated equipment with weak default security, creating overlapping vulnerabilities.

> has to hold both stories at once
## Key takeaway

Water providers face two separate security threats: stolen credentials that hackers can easily exploit, and outdated equipment with default passwords that Iran-backed groups have already targeted.