Skip to main content
OT Atlas
Search

2021 · Water / Wastewater

Oldsmar Water Treatment Access Incident

Unauthorised remote access to a water treatment plant HMI was used to change a chemical setpoint. An operator observed the change and reverted it immediately; treated water was not affected.

Direct OT impactUnited States (Florida)

What happened

Someone with access to a remote desktop capability changed the sodium hydroxide setpoint dramatically. The change was noticed on screen and reversed within minutes.

Who

Not publicly attributed; subsequent reporting raised questions about the exact sequence of events.

Where

A small municipal water treatment facility in Florida, United States.

Why

Unknown.

How

Remote desktop access to an HMI with shared credentials, reachable from outside the plant network.

Timeline

  1. 5 February 2021Two remote access sessions observed; setpoint change made and reverted
  2. February 2021Advisories published highlighting remote access and end-of-life software risks

Attack path

Described at the level required to build detection and controls.

Initial Access

Reported

Remote desktop session to an HMI

Control systems

Reported

Chemical setpoint modified via the HMI

Physical consequence

Reported

Reverted before any process effect

Impact

OT impactA setpoint change was made through legitimate operator interface functionality.
Safety impactPotential public-health impact avoided by operator observation and downstream controls.
Operational impactMinimal; process controls and human observation caught the change.
Detected byAn operator watching the HMI screen.

Technology involved

HMI with remote desktop softwareWindows systems reported as end-of-lifeChemical dosing control

ATT&CK techniques

T0822T0831T0855

Vulnerabilities and weaknesses exploited

  • Shared credentials and unsupported operating system reported as contributing conditions

Control failures

  • Shared remote access credentials
  • No MFA
  • Remote desktop reachable without a mediated path
  • End-of-life systems

Where earlier detection was possible

  • Alerting on remote sessions to operator stations
  • Setpoint change alarms with engineering limits
  • Removing direct remote desktop exposure

Defensive lessons

  • Small utilities need the same access fundamentals as large ones
  • Process alarms with engineering-validated limits are a strong safety net
  • Shared credentials remove all accountability

Why should I care?

Case studies are only useful if they change something. Pick one lesson above and check whether the control exists in your own environment this week.

Sources & further reading