New research from cybersecurity firm SpyCloud has uncovered a significant vulnerability affecting over 1,700 U.S. water and wastewater providers. Malware capable of stealing employee passwords and active session data has compromised close to 20% of these organizations’ public-facing systems, many of which are registered with the U.S. Environmental Protection Agency. Alarmingly, at least 250 of the affected entities had credentials exposed that could grant direct access to operational networks controlling water pumps and flows, posing a severe threat to critical infrastructure.

SpyCloud’s investigation revealed a single breached metering technology provider as a major weak point, with malware on one of its devices extracting credentials for 167 utility companies. According to SpyCloud’s Chief Investigations Officer Jason Lancaster, this single infection effectively gave hackers access to numerous unrelated organizations, amplifying the risk across the sector. The password-stealing malware, often called infostealers, can capture stored passwords and session tokens that allow attackers to bypass multi-factor authentication, thereby facilitating easy entry into secure systems without the need for advanced AI tools.

These new findings come amid ongoing attacks on U.S. water systems attributed to Iran-backed hackers, although SpyCloud notes that their analysis did not find evidence linking the password theft to those specific nation-state campaigns. Instead, many breaches stem from fundamental security weaknesses such as default manufacturer passwords in critical infrastructure hardware. SpyCloud emphasizes that stolen credentials remain a widely traded commodity among cybercriminals and represent a consistent threat alongside known vulnerabilities in industrial control systems.

For the water sector, this research highlights the urgent need to strengthen cybersecurity practices, including better password management, monitoring for malware infections, and securing operational technology systems. Lancaster advises the industry to confront the dual challenge posed by both credential theft and the inherent risks of outdated infrastructure. As attacks on America’s water supply escalate, safeguarding these critical systems against such accessible hacking tactics is imperative to prevent potentially devastating disruptions.