Last Updated: February 2021

In February 2021, the water treatment plant in Oldsmar, Florida, came within minutes of a disaster that could have poisoned 15,000 residents. Attackers hacked into the plant’s SCADA system using stolen TeamViewer credentials and cranked up sodium hydroxide (lye) levels from 100 ppm to a deadly 11,100 ppm. A sharp-eyed operator caught the mouse moving on its own and reversed the damage just in time, but let’s be real: this should never have gotten that far. Legacy MFA—or the lack of anything better—left the door wide open. Here’s how it all went wrong and why the old-school approach to security is a ticking time bomb.

The stakes couldn’t be higher. According to IBM’s 2025 Cost of a Data Breach Report, the global average cost of a breach hit $4.44 million, and that’s just the financial hit. For critical infrastructure like water plants, the real cost is measured in lives. And with an average of 241 days to identify and contain a breach, per the same report, relying on detection is a gamble we can’t afford.

How It Happened: A Credential Catastrophe

The Oldsmar attack wasn’t some sophisticated zero-day exploit or nation-state wizardry. It was embarrassingly simple: attackers got their hands on TeamViewer credentials, likely through phishing or just guessing a weak password. Maybe someone reused “Password123” across accounts. Maybe they clicked a dodgy link. Whatever the case, once inside, they had full control of an operator workstation. They didn’t need to bypass fancy firewalls or crack encryption—they just logged in like they owned the place.

Legacy MFA, if it was even in use, clearly didn’t cut it. SMS codes? Phishable. Push notifications? Interceptable. Passwords plus a second factor? Still stealable if the first factor gets compromised. The whole system is built on sand, assuming attackers won’t figure out how to trick a human or snag a code. Spoiler: they always do.

Why Legacy MFA Failed Hard

Let’s break this down. Legacy MFA is obsessed with layering more stuff on top of passwords—think SMS, apps, or tokens. But here’s the dirty secret: if the core credential is stealable, no amount of extra steps will save you. The Oldsmar attackers didn’t need to hack a token; they just needed the login details, and boom, game over. Even “strong” MFA can crumble under social engineering or a reused password from a unrelated breach.

And critical infrastructure? It’s often stuck with outdated systems and shared credentials because “that’s how we’ve always done it.” TeamViewer with a weak password was the skeleton key to a potential mass poisoning. Legacy MFA doesn’t fix human error or sloppy practices—it just adds a flimsy speed bump that attackers laugh at.

The Damage: A Near-Miss With Deadly Consequences

This wasn’t a data leak or a ransomware payout. This was an attempt to poison a town’s water supply. Sodium hydroxide at 11,100 ppm isn’t a prank—it’s a weapon. If the operator hadn’t been watching the screen at that exact moment, we’d be talking about a body count, not a close call. Critical infrastructure isn’t just another target; it’s where breaches turn into real-world nightmares. Legacy MFA’s failure here isn’t a glitch—it’s a systemic disaster waiting to happen again.

Prevention Exists, But It’s Not What You’re Using

Here’s the kicker: this entire mess was preventable. Not with more layers of legacy MFA nonsense, but with a complete rethink of authentication. Phish-proof, passwordless solutions like IDEE AuthN exist, focusing on Prevention — Not Detection. They kill the attack before it starts by eliminating stealable credentials altogether. For a deeper dive into why this matters, check out The Benefits.

The fix isn’t complicated, but it requires ditching legacy MFA entirely. The full technical breakdown of what actually works is at mfa2point0.com.

FAQ: What Frustrated IT Managers Want to Know

Q: Why does legacy MFA keep failing in high-stakes environments like Oldsmar?
A: Because it’s built on stealable credentials. Passwords, SMS codes, even tokens—attackers can phish or intercept them. If the foundation is weak, the whole system collapses.

Q: We can’t afford a breach like this. Why isn’t everyone switching to something better?
A: Inertia and budget excuses. Too many orgs stick with “good enough” until disaster hits. Plus, they don’t realize how easy modern phish-proof MFA can be to deploy.

Q: Was Oldsmar just bad luck, or are we all screwed?
A: Not luck—a predictable failure. Critical infrastructure is a juicy target, and legacy MFA is a paper shield. You’re only safe if you ditch the old stuff for prevention-focused tech.