US Water Supply Systems Targeted by Hackers

It has been revealed that over a thousand US water and wastewater service providers are at serious cyber risk due to malware capable of stealing employee credentials and active session tokens. According to ixbt.com, a study by cybersecurity firm SpyCloud showed that critical infrastructure facilities are prone to relatively easy breaches. This was reported by Techcrunch.com reporting that.

Experts note that while infostealer-type malware is not new, its widespread prevalence is providing hackers with easy access to networks even without the use of AI tools. SpyCloud analyzed a database of over 66,000 exposed systems belonging to nearly 10,000 organizations registered with the US Environmental Protection Agency.

According to the study, nearly 20 percent of the providers checked—specifically 1,787 organizations—had employee data stolen by malware. At least 250 of these had credentials exposed that provide direct access to operational networks and remote access systems controlling water flow and pumps.

Supply chain and single points of failure

During the analysis, it was discovered that a device in the network of an unnamed measurement technology provider was also infected with malware. Through this device, passwords for 167 utility companies relying on this technology were stolen. SpyCloud representative Jason Lancaster noted that this single breach allowed criminals to infiltrate hundreds of unrelated organizations.

Infostealer programs steal not only saved passwords but also session tokens that indicate a user is active in the system. This allows hackers to log in as legitimate users and bypass multi-factor authentication (MFA) systems. Criminals trade such data on specialized platforms.

Other infrastructure threats and conclusions

This study was published following a series of cyberattacks on US water utilities. Government circles link these attacks to groups associated with Iran. However, SpyCloud experts stated they found no evidence that stolen passwords were used in the Iran-linked attacks.

In those cases, the problem was more related to vulnerabilities such as default passwords on physical controllers and mechanical switches. Nevertheless, experts emphasize that password theft remains one of the primary threats to critical infrastructure security and that the water sector must address all these risks simultaneously.