Stolen Credentials Open New Front In Assault On U.s. Water Systems

Password-stealing malware has compromised credentials at nearly 1,800 U.S. water and wastewater organizations. The exposure leaves pumps, treatment plants and remote monitoring systems vulnerable to anyone who buys the data on criminal markets.

Researchers at SpyCloud examined records tied to roughly 10,000 such providers. They discovered active infostealer infections linked to 1,787 of them. That figure equals almost two in every ten checked. At least 258 carried credentials for operational technology networks or remote access tools that directly manage physical processes.

One infected device told a particularly troubling story. It belonged to an unnamed smart-meter technology vendor. The malware on that single machine had harvested saved logins connected to 167 different U.S. utility customers. A breach at the supplier could cascade across hundreds of water systems at once. Supply chains have become the soft underbelly.

The findings, released Tuesday, arrive weeks after a wave of attacks that struck water facilities in at least a dozen states. Federal officials privately linked many of those incidents to Iran-backed groups. Yet SpyCloud reported no signs that the earlier hacks used stolen passwords. The threat actors instead exploited internet-facing programmable logic controllers with weak or default credentials.

But the new data shows another path exists. And it requires even less sophistication. Infostealer malware quietly logs keystrokes, grabs browser data and exfiltrates session cookies. Criminal groups then sell or trade the logs. Buyers scan for targets in critical sectors. Water utilities, many of them small and underfunded, appear frequently.

Jason Lancaster, chief investigations officer at SpyCloud, described the exposure as concentrated among larger operators and their vendors. Smaller utilities were largely underrepresented in the dataset. That gap doesn’t mean they are safe. It means the problem may run deeper than the numbers suggest. One breach at a vendor can expose dozens of clients.

The July and August attacks followed a familiar pattern. Hackers scanned for exposed PLCs from manufacturers such as Rockwell Automation. Many devices sat directly on the public internet. Some used factory passwords like “1111” or no authentication at all. Once inside, attackers changed IP addresses and reset passwords. Operators lost visibility and control. Communities issued boil-water notices. Staff switched to manual operations. Service usually returned within hours.

Those incidents prompted urgent warnings from the Cybersecurity and Infrastructure Security Agency, the FBI and the Environmental Protection Agency. The agencies told operators to unplug vulnerable controllers from the internet immediately. They also urged stronger network segmentation between information technology and operational technology environments.

Yet the SpyCloud research highlights that perimeter defenses alone won’t suffice. Credentials harvested from employees’ laptops or shared vendor accounts can bypass firewalls and air gaps. A contractor who manages billing software for multiple towns might hold keys to remote-access portals. If that contractor’s machine is infected, every customer is at risk.

Infostealers have proliferated in recent years. Security teams trace them to information-stealing trojans spread through phishing emails, cracked software and malicious ads. Once installed, they harvest far more than passwords. Saved sessions, API tokens and browser cookies allow attackers to impersonate users without triggering multi-factor authentication prompts.

SpyCloud built its analysis from a database of 66,845 EPA-registered water systems. The firm matched internet domains, examined leaked logs and cross-referenced with known infostealer datasets. The 1,787 organizations showed signs of active exposure. That means the stolen data still circulates in criminal channels and retains value.

Separately, the company identified 263 organizations targeted in active phishing or business email compromise campaigns. The overlap paints a picture of sustained adversary interest. Water systems face both opportunistic criminals chasing quick ransoms and nation-state actors probing for strategic advantage.

The metering vendor incident stands out. A single compromised device yielded credentials for 167 utilities. Many of those customers likely never knew their access details had been stolen. The vendor itself may not have detected the infection. Such blind spots are common. Most organizations only learn of infostealer compromises when researchers or law enforcement notify them.

Earlier this year, reports from The New York Times detailed how years of warnings about weak water infrastructure security went largely unheeded. Roughly 150,000 public water systems operate across the country. Many are run by small towns with limited budgets and few dedicated cybersecurity staff. Default passwords and internet-exposed devices have persisted despite repeated alerts.

In Minnesota alone, more than 30 communities faced coordinated intrusions in late July 2026. Officials in Braham, Plymouth and other towns confirmed temporary loss of automated controls. Similar reports surfaced from Michigan, Georgia, New Jersey and South Dakota. At least 100 municipalities detected suspicious activity, though not all were confirmed as part of the same campaign.

A joint advisory from the FBI and EPA on July 30 noted that some attacks degraded operations. Pressure dropped. Lift stations malfunctioned. In one Georgia county, officials issued a precautionary boil-water advisory after a brief disruption. No evidence emerged that attackers altered chemical treatment or contaminated supplies. The goal appeared to be disruption and demonstration of access.

But the latest SpyCloud data suggests future attacks could grow more ambitious. Operational credentials in the wrong hands allow direct manipulation of valves, pumps and treatment processes. An attacker with valid remote-access logins could issue commands indistinguishable from legitimate operator actions.

Small utilities face particular challenges. They often rely on third-party vendors for SCADA systems, metering technology and cloud-based monitoring. Those vendors become high-value targets. Compromise one, and the blast radius expands across dozens or hundreds of clients. The cascading supply chain exposure SpyCloud documented illustrates this risk perfectly.

So what now? Federal agencies have offered grants to improve water sector cybersecurity. The EPA has allocated millions for technology upgrades and training. Yet progress remains slow. Many systems still run legacy equipment that cannot support modern authentication methods. Budgets prioritize pipes and pumps over software patches.

Experts recommend several immediate steps. Operators should audit all remote-access tools and retire those that aren’t essential. They must enforce unique, strong credentials for every account and rotate them regularly. Multifactor authentication, where technically feasible, adds another barrier. And continuous monitoring for compromised credentials through services like SpyCloud can provide early warning.

The metering vendor case offers a clear lesson. Organizations must extend visibility beyond their own networks. They need to understand risks in their supply chain and demand security standards from contractors and technology providers. A single infected laptop at a vendor can undermine years of hardening at the utility level.

Recent coverage from CyberScoop reinforced the quantitative scale of the problem. The publication noted that exposure appears higher among larger operators, exactly the entities responsible for serving millions of customers. The smaller, rural systems that showed up less frequently in the data may simply lack the digital footprint that makes them visible to researchers.

That invisibility cuts both ways. It means threats could be brewing undetected in thousands of overlooked facilities. And it underscores how fragmented the nation’s water security posture remains.

Attacks on critical infrastructure carry strategic weight. Iran-linked groups have targeted U.S. water systems for years, often as retaliation for sanctions or military actions. The July campaign coincided with heightened tensions. While no deaths or major contamination occurred, the incidents served as a proof of concept. Future operations could aim for longer disruptions or actual physical damage.

Criminal actors present a parallel threat. Ransomware groups have hit water utilities before, though most incidents involved encryption of administrative systems rather than direct control of treatment processes. Stolen operational credentials raise the possibility of more dangerous extortion tactics. Pay us, or we alter the chlorine levels.

The combination of nation-state persistence and criminal opportunism creates a complex defense environment. Utilities cannot assume that unplugging a few PLCs solves the issue. The identity layer has become just as critical as the network perimeter.

SpyCloud’s report carries one more sobering detail. The company analyzed only a fraction of the total attack surface. Its database covered EPA-registered systems, but many private or industrial water operations fall outside that list. The true number of exposed organizations is likely higher.

Officials have raced to respond. State regulators in Colorado disclosed in mid-September that foreign actors briefly compromised two small private water utilities serving fewer than 200 people each. The intruders changed equipment settings, disabled alarms and altered pumping cycles. Operators restored control quickly. No water quality impacts occurred. Yet the incidents show the threat persists even after public warnings.

Industry leaders now call for mandatory minimum cybersecurity standards for water systems, similar to those imposed on electric utilities. Funding remains a sticking point. Small towns cannot absorb the cost of modern secure remote access without federal support.

Meanwhile, the stolen credentials keep circulating. Each new infostealer log adds fresh material to criminal databases. Passwords harvested months ago can still work if unchanged. Session cookies expire more quickly but still provide windows of access.

The path forward requires both technical fixes and policy changes. Utilities must hunt for exposed credentials as aggressively as they monitor for malware. Vendors must secure their own environments and limit the privileges granted to customer accounts. Regulators need better visibility into supply-chain risks.

Until then, America’s water providers will remain one leaked password away from compromise. The pumps keep running for now. But the adversaries are already inside the logs.