An investigation is underway into a cyberattack on the city of Oldsmar’s water supply.
The attack happened on Friday, Pinellas County Sheriff Bob Gualtieri said.
Twice, an intruder logged into a computer at Oldsmar’s water treatment plant. An employee noticed the first log-in around 8 a.m., but did not think it was unusual because city staff have remote access to the system.
Gualtieri said the second breach, which took place around 1:30 p.m., was more noticeable because an employee could see the mouse pointer move on the computer screen.
“The person remotely accessed the system for about three to five minutes, opening various functions on the screen,” Gualtieri said at a press conference Monday. “One of the functions opened by the person hacking into the system was one that controls the amount of sodium hydroxide in the water.”
Also known as lye, the chemical is used in tiny amounts to remove metals and improve the water’s pH balance. Gualtieri said the intruder raised the level from 100 parts per million to 11,000 parts per million.
A water plant operator noticed the increase and reversed it as soon as it happened. Gualtieri and Oldsmar mayor Eric Seidel said there was no danger to the water supply because the employee acted quickly.
“Even had they not caught them, there's redundancies that have alarms in the system that would have caught the change in the pH level anyhow,” Seidel said.
Gualtieri said the FBI and U.S. Secret Service are part of the investigation.
“Right now, we do not have a suspect identified, but we do have leads that we are following,” he said. “We don't know right now whether the breach originated from within the United States or outside the country.”
Oldsmar joins a list of Florida cities that have suffered serious cyberattacks. In 2019, Riveria Beach paid a $600,000 ransom after hackers disabled its computer systems for three weeks. The same year, Lake City paid $480,000 to end a cyberattack.
