On 5 February 2021, unidentified actors accessed a US drinking water plant's SCADA system and raised sodium hydroxide dosing. Staff noticed and reversed it before any alarm, and treatment continued normally, according to CISA advisory AA21-042A. The likely causes were weak passwords and an outdated operating system.
What the advisory confirms
The advisory describes unauthorized access to the SCADA software, followed by a change to chemical dosing levels. Plant personnel saw the change and reversed it. The advisory does not name the city, and the only location clue is a reference to the Pinellas County Sheriff's Office among the responders, alongside the Secret Service and the FBI.
It says the actors likely got in through weak password security and an outdated operating system, and that desktop sharing software such as TeamViewer may have been used, though that was unconfirmed. The FBI could not confirm that the incident was a targeted intrusion.
Be careful with details you may have read elsewhere. Numbers and motives that do not appear in the advisory should be treated as unverified.
What the agencies recommend
General hygiene:
- Move to a supported operating system. The advisory notes that Windows 7 support ended on 14 January 2020.
- Use multifactor authentication and strong RDP credentials.
- Keep security tools current, audit networks, and isolate systems that cannot be updated.
- Close unused RDP ports and log RDP login attempts.
- Audit logs for every remote connection protocol.
For remote control software:
- Disable unattended access features.
- Use long random passwords and do not save connection passwords.
- Tier the access granted to remote parties and require host confirmation for anything beyond view only.
- Use block and allow lists.
The most important recommendation
For water and wastewater, the advisory recommends independent cyber-physical safety systems that physically prevent dangerous conditions even if the control system is compromised. Examples include limits on chemical pump and reservoir size, valve gearing and pressure switches.
That is a design principle worth copying. Software controls can fail. A mechanical limit does not care who has the password. Our post on independent safety limits goes further.
What to do this month
- List every remote access tool that can reach a control system, including ones staff installed on their own.
- Check the operating system version of every workstation that can change a setpoint.
- Ask operators which setpoint changes they would find suspicious, and whether an alarm would fire before harm occurs.
- Check which physical limits exist if software misbehaves.
Why a small detail matters
The advisory notes that plant personnel saw the change themselves, before the software alarmed. That is a reminder that human attention is a control too. Operators who know what normal looks like, and who are encouraged to speak up, add a layer no tool provides. Make sure your alarm thresholds are not the only thing standing between a setpoint change and harm.
Quick check
Was the intruder identified?
The advisory refers to unidentified actors and says the FBI could not confirm it was a targeted intrusion.
Was the public in danger?
The advisory says staff reversed the change and that treatment continued normally.
If you maintain software that connects to plants like this, Safeguard can scan your dependencies and flag known vulnerabilities, and there is a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
