Stolen passwords are exposing America’s water providers to hackers

SpyCloud research found infostealer malware stole credentials from 1,787 US water providers, including 250 with operational-network and remote-access exposure.

SpyCloud analyzed 66,000 EPA-registered public-facing systems across 10,000 water and wastewater organizations and found password-stealing malware had compromised credentials at 1,787 providers, nearly two in ten. At least 250 organizations had exposed credentials granting access to operational networks and remote-access systems controlling pumps and water flows. A single infected device at an unnamed metering tech provider leaked credentials for 167 utilities, and SpyCloud found no evidence recent Iran-linked water-sector hacks relied on stolen passwords, which instead exploited default passwords in infrastructure controllers.