On 5 February 2021 an unauthorized actor gained remote access to the City of Oldsmar, Florida water-treatment SCADA and briefly raised sodium hydroxide (lye) dosing. According to the joint CISA/FBI/EPA/MS-ISAC advisory AA21-042A, plant personnel noticed the change and corrected it before the SCADA software alarmed. The water treatment process remained unaffected. Public reporting places the plant at roughly 15,000 customers. The advisory cites poor password security and an outdated operating system, and notes desktop-sharing software such as TeamViewer as a possible path that was not confirmed at the time. Contemporaneous coverage described employees sharing a TeamViewer remote-access password; Florida FDLE commentary after the incident pushed two-factor authentication, indicating 2FA was not protecting that remote path.
If you want the prevention angle, read the related article on mfa2point0.com.
FAQ
How did attackers get into Oldsmar’s water-treatment SCADA?
Attackers reached Oldsmar’s water-treatment SCADA through unauthorized remote access on 5 February 2021, not through a documented malware implant or stolen cloud session token. According to CISA AA21-042A, the actors likely exploited cybersecurity weaknesses including poor password security and an outdated operating system. Contemporaneous reporting stated employees shared a TeamViewer remote-access password, and post-incident FDLE commentary highlighted promoting two-factor authentication, which indicates 2FA was not gating that remote path. Possession of the remote password was enough to complete login. Public reporting does not establish a named threat actor or a confirmed targeted intrusion; the FBI stated it could not confirm the incident began as a targeted cyber intrusion.
Was TeamViewer confirmed as the entry tool?
No. CISA AA21-042A says early information indicated desktop-sharing software such as TeamViewer may have been used, and explicitly states that could not be confirmed at the advisory date. Ars Technica and other contemporaneous coverage reported a shared TeamViewer password among Oldsmar staff. Treat confirmed facts as poor password security on a remote-access path; treat TeamViewer as reported and possible, not as a CISA-confirmed finding.
Did legacy MFA fail at Oldsmar, or was it simply missing?
For the Oldsmar remote SCADA path, public reporting describes missing multi-factor protection rather than a defeated OTP or push ceremony. FDLE’s post-incident push to promote two-factor authentication is the signal that 2FA was not protecting remote access. AA21-042A’s mitigations recommend multiple-factor authentication and strong passwords for remote access and RDP. A shared remote password with no second factor is a credential-phase failure: authentication never demanded a non-transferable factor bound to a specific operator. A fix that removes shared, phishable remote secrets exists; the companion piece covers prevention without replaying the incident narrative.
Did altered chemistry reach public drinking water?
No. According to CISA AA21-042A, water treatment plant personnel immediately noticed the dosing change and corrected it before the SCADA system’s software detected the manipulation and alarmed. The advisory states the water treatment process remained unaffected and continued to operate as normal. The chemical change was a process-control event reversed on site. It was not a delivered-water poisoning event, and public reporting does not establish ransom demands or data exfiltration from this incident.
Would a stronger shared password alone have stopped this?
A stronger shared password would only have raised the bar on guessing or reuse. It would not have fixed the architecture problem at Oldsmar: one transferable secret, usable by anyone who held it, with no second factor on the remote path. AA21-042A pairs strong passwords with multiple-factor authentication for remote access for that reason. Once a shared remote password is the only gate, loss or leakage of that secret is full access. Closing password-only remote SCADA login is the prevention claim. Endpoint malware after a legitimate operator session is a harder, separate problem.
