On 5 February 2021, an operator at a small Florida water treatment plant noticed his cursor moving on its own. Someone was inside the plant’s TeamViewer session, probing the sodium hydroxide setpoint — a chemical controlled at 100 ppm, being pushed toward 11,100 ppm. The intrusion was caught and reverted in minutes. It should not have been possible at all.
The Oldsmar, Florida water treatment facility intrusion saw an unauthorised remote user access a plant operator’s workstation via TeamViewer and raise the sodium hydroxide (lye) dosing setpoint from 100 ppm to 11,100 ppm. An operator witnessed the change in real time and reverted it immediately; water never reached unsafe levels. Investigation found the plant’s computers shared passwords, ran a shared Windows 8 machine, had no firewalls installed, and used both TeamViewer and direct internet remote access for vendor support. The durable lesson: operational-technology security failures compress to “direct internet access + shared credentials + no segmentation” — and luck is not a control. Legacy plants worldwide run this configuration today.
What happened
The Pinellas County Sheriff’s Office laid out the facts in a 8 February 2021 press conference. Around 8 a.m. on 5 February, a plant operator noticed a remote session take control of his workstation briefly, then disconnect. Around 1:30 p.m. the same day, a second session connected and, over three to five minutes, opened the plant’s SCADA software (a browser-based Rockwell interface), navigated to the sodium hydroxide dosing function, and raised the setpoint from 100 ppm to 11,100 ppm. The watching operator immediately reduced it back. Had the change gone unnoticed, the elevated lye concentration would have damaged pipes and equipment within hours; the plant’s normal 24-hour cycle meant contaminated water could plausibly have reached taps before the next routine check.
What turned a near-miss into a national case was the post-incident disclosure of the plant’s security posture. The advisory issued after the incident, and reporting on the Massachusetts advisory summarising the investigation, documented: all computers shared the same password for remote access; employees had used the TeamViewer-installed machine for day-to-day work including email and browsing; the facility ran an end-of-life Windows 8 workstation; plant systems had direct internet connectivity without firewall segregation; and remote-access software was installed on all computers, sometimes in always-on configurations. Access had likely been trivially obtained through a reused or leaked credential.
Attribution closed as “unknown and unattributed” — no arrests, no group claims, and later analyses suggested anything from targeted probing to an opportunistic scan of exposed TeamViewer endpoints. The lack of a dramatic actor did not blunt the policy response: the episode became the Biden-era civilian-cybersecurity push’s most-cited example, was invoked in EPA water-sector security initiatives and the 100+ bills that followed across US states, and remains the standard opening anecdote in operational-technology security training. For a small plant with a budget too thin for a SOC, the final line of defense was one alert human — and five minutes of attention.
How it worked
There was no exploit chain to speak of. The intrusion pathway was administrative: internet-exposed remote-access endpoints plus credential hygiene, wrapped around a flat network where the business PC and the SCADA shaping drinking water shared one environment.
internet-exposed TeamViewer (plant workstation)
shared passwords across plant PCs
no firewall between business LAN and SCADA LAN
|
remote user logs in AS the operator (session looks legitimate)
-> opens SCADA HMI (browser-based, Rockwell Citect-era UI)
-> navigates physical process screens
-> raises NaOH setpoint 100 -> 11,100 ppm
|
operator observes cursor + change in real time -> reverts in minutes
(detect control = a person watching; no independent alarm fired)Two engineering realities matter for readers evaluating their own OT risk. First, the dosing change itself had physical inertia on its side: treatment chemistry and the plant’s 24-hour retention meant the operator had hours of margin, not seconds — but only because the change targeted a slow-acting parameter rather than, say, chlorine dosing timing. Second, the detection was not the SCADA control system’s: no safety-instrumented alarm caught the out-of-band setpoint write. The control that saved Oldsmar was an operator who happened to be watching the screen — the definition of an unengineered control. Modern OT programs formalise this into setpoint-write alarming, unidirectional gateways, and dedicated jump hosts, precisely because they cannot staff every screen 24/7.
Impact and numbers
| Metric | Value | Source |
|---|---|---|
| Date & location | 2021-02-05, Oldsmar, FL (pop. ~15,000) | Pinellas County SO presser |
| Parameter attacked | Sodium hydroxide 100 → 11,100 ppm | sheriff’s affidavit / MA advisory |
| Time between intrusion and revert | 3–5 minutes | operator statements |
| Water quality impact | None — reverted before dosing shifted output | Pinellas County / city statements |
| Security findings | Shared passwords, EOL Windows 8, no firewall, TeamViewer on all PCs, direct internet access | Massachusetts RHSRV advisory 2021-02-11 |
| Attribution | Unknown / unattributed | FBI / Sheriff’s office close-out |
Timeline
| Date | Event |
|---|---|
| 2021-02-05 08:00 | First brief remote session on operator workstation |
| 2021-02-05 13:30 | Second session; NaOH setpoint raised 100→11,100; operator reverts within minutes |
| 2021-02-05 (pm) | Plant disables remote access; city notifies law enforcement |
| 2021-02-08 | Pinellas County Sheriff press conference — national story |
| 2021-02-11 | Massachusetts RHSRV advisory details control failures |
| 2021-03 onward | EPA audits; state legislatures propose 100+ water-security bills |
Why it still matters in 2026
Oldsmar is the exception that proves the rule: nothing about it was sophisticated, and that is exactly why it generalized. The intrusion required no zero-day and no APT — only an exposed remote-access endpoint and a shared password — the same configuration audit after audit finds in water utilities, manufacturing lines, and building-management systems worldwide. When regulators and CISOs argue that critical-infrastructure security must assume legacy constraints (unpatchable HMIs, flat networks, skeleton crews), Oldsmar is Exhibit A. It anchors our coverage of critical-infrastructure threats, and it is the reason setpoint-write monitoring and OT jump hosts are now baseline
recommendations rather than premium extras. The counterfactual keeps it relevant: five minutes of operator inattention anywhere else in the chain, and 2021’s biggest infrastructure story is a poisoning.
Detection and hardening takeaways
- Remove direct internet access to OT. Remote support belongs on hardened jump hosts with MFA and session recording — never an always-on consumer remote-access tool on the HMI.
- Kill shared credentials. Per-user accounts on plant systems; vendor access timed, logged, and individually attributable.
- Alarm on out-of-band setpoint writes. Any change to dosing or process setpoints outside authorised maintenance windows should page a human — independent of whoever (or whatever) made the change.
- Segment business from process. A browsing-and-email PC must not share a LAN with chemical dosing controls; unidirectional gateways exist for exactly this boundary.
- Upgrade EOL operating systems on plant floors. Windows 8 in 2021 was not a budget quirk; it was an unmanaged liability with a physical blast radius.
FAQ
Could the water actually have become dangerous?
Plausibly, yes — though “poisoned taps within hours” overstates it. At 11,100 ppm the lye concentration would have damaged plant equipment and piping and required shutdown and flushing; whether output reached consumers depended on retention time and monitoring downstream. The 24-hour treatment cycle gave operators hours of reaction margin. The save was early human detection, not chemical safety systems.
Who did it?
Officially: unknown. The investigation closed without attribution or arrest. Speculation ranged from foreign probing to bored intruders hunting exposed TeamViewer endpoints. The absence of a named actor is itself the lesson — the intrusion was possible without skill, funding, or intent.
Our OT network is air-gapped. Does Oldsmar apply to us?
The plant believed remote access was necessary for vendor support, and that belief — not negligence — created the path in. Audit your vendor-access pathways: every “temporary” remote tool, every shared login, every flat link between IT and OT. Most “air-gaps” turn out to be vendor-VPN-shaped. Oldsmar’s configuration was found everywhere once auditors started looking.
