New research from cybersecurity firm SpyCloud found that password-stealing malware exposed credentials linked to 1,787 organizations across the U.S. water sector, creating potential access points for hackers. At least 250 organizations had exposed credentials that appeared capable of reaching operational networks or remote-access systems used to control equipment such as pumps and water flows.
The findings come as U.S. water and wastewater providers face a series of cyberattacks. SpyCloud’s research focuses on a separate risk: passwords and active login sessions stolen from employees and technology vendors by information-stealing malware.
One Infected Device Exposed Credentials From 167 Utilities
For its water sector analysis, SpyCloud assembled information on more than 66,000 public-facing systems registered with the U.S. Environmental Protection Agency and analyzed 10,000 organizations. It found credentials stolen by information-stealing malware at 1,787 of them, equivalent to nearly two in 10 organizations examined.
One case involved an unnamed metering technology provider whose network contained a device infected with password-stealing malware. The compromised device held credentials associated with 167 U.S. utility companies that used the provider’s technology.
SpyCloud Chief Investigations Officer Jason Lancaster said one infected vendor device could therefore expose access information tied to more than 100 otherwise unrelated organizations. The finding also shows how a compromise at a technology supplier can affect multiple utility customers.
Information stealers can collect stored passwords and session tokens that keep users logged into online accounts. Stolen session tokens can allow an attacker to act as an authenticated user and, in some cases, bypass multi-factor authentication without needing the user’s password.
Stolen Credentials Add Another Risk for Water Providers
The research follows recent attacks against U.S. water systems that government officials have linked privately to Iran-backed hackers. SpyCloud said it found no evidence that stolen passwords were used in those incidents.
Instead, evidence in those cases pointed to weaknesses in operational technology, including manufacturer-set default passwords on internet-connected controllers. U.S. agencies including the Cybersecurity and Infrastructure Security Agency have previously warned water providers about weaknesses in remotely accessible operational systems.
SpyCloud said identity exposure and weaknesses in operational technology should be treated as separate security problems. Stolen credentials are available to anyone who can obtain them from criminal markets, while exposed industrial systems can provide another route into water infrastructure.
The firm’s findings identify potential access paths rather than confirming that every exposed organization has been breached. Determining whether stolen credentials were actually used requires examining account status, authentication records and the systems those accounts could access.
Featured image credits: Magnific.com
For more stories like it, click the +Follow button at the top of this page to follow us.