Mainstream media news about hackers often portrays them as petty criminals out to make a quick buck or unconscientious agents working at the behest of some nefarious organization or government. Often, the effects of their actions range from comical annoyances to frightening privacy invasions but only a few have been considered life-threatening on a large scale. Unfortunately, that was almost the reality that citizens of Oldsmar, Florida faced when a hacker tried to poison the entire city through its water supply.
It was Friday morning when an employee at the city’s water treatment plant noticed his computer’s mouse cursor moving on its own. Familiar with the normal use of remote access by authorized personnel, the employee didn’t mind it until the operator noticed the same incident later in the afternoon, this time using remote access to increase the amount of sodium hydroxide or lye in the water from 100 parts per million to 11,100 parts. Lye is used to regulate the PH balance of drinkable water in small quantities is poisonous to humans at higher levels.
The worst-case scenario, fortunately, didn’t occur as the operator quickly returned the levels back to normal before it could have any effect. Even if that much lye got out, the plant’s redundant systems would have alerted them to such a situation and it would take 24 to 36 hours before the tainted water would even reach the city’s population.
Regardless, the incident caused no small amount of concern from both local and federal authorities. This is perhaps one of the few instances of a publicly reported hacking incident that was intended to cause physical harm rather than just pilfering data. Last year, there were reports of a ransomware attack indirectly resulting in a German woman’s death due to delay, though the actual cause was later clarified to be unrelated.
Authorities are still investigating the incident and have yet to determine whether the attack was done locally, nationally, or even outside the country. Senator Marco Rubio (R-FL) has called on the FBI for assistance and wants it to be treated as a matter of national security.