A water plant, TeamViewer and a shared password
Someone remotely changed chemical levels at a Florida water plant. Reports point to shared TeamViewer access and Windows 7.
This month an intruder took remote control of a computer at the water treatment plant in Oldsmar, Florida, and raised the level of sodium hydroxide to a dangerous amount. An operator saw the mouse moving and reversed it straight away. Nobody was harmed.
Reports since then describe the setup: TeamViewer for remote access, one password shared by staff, computers on Windows 7, connected to the internet.
That setup is common far beyond water plants. Factories, clinics and small offices use remote tools the same way.
What to fix:
- Every person gets their own login, with MFA. No shared passwords.
- Remote access through a VPN or a managed gateway, not a tool open to the world.
- Remove remote tools nobody uses, and alert when one is installed.
- Keep control systems separate from the office network and the internet.
- Plan to replace Windows 7. It stopped getting free updates a year ago.
The operator who noticed saved the day. Don’t build your safety on someone looking at the screen.