Water utility · 2021
Oldsmar water plant: the remote-access incident
The cursor that moved on its own.
What happened
On February 5, 2021, an operator at the Oldsmar, Florida water plant reported seeing the cursor move remotely and the sodium-hydroxide setting rise from 100 to 11,100 parts per million. He reversed the change within minutes, and layered treatment controls meant the altered setting never reached the public water supply.
The incident exposed a serious cybersecurity weakness in critical infrastructure. The plant used outdated Windows systems and weak remote-access practices, including a shared TeamViewer password that could reach the control environment. A remote session had a path to the interface used to dose a city's water. Sensitive industrial controls lacked the access restrictions, separation and accountability their consequences required.
What would have changed it
Critical controls should never depend on a shared password or an ambiguous screen event. We restrict remote access, separate industrial systems and preserve evidence that can explain what actually happened.