What happened at the Oldsmar water plant, and what defenders learned

In February 2021, someone used remote control software on a computer at the water treatment plant in Oldsmar, Florida, and raised the sodium hydroxide setting. An operator noticed and reversed it. Officials said the public was never in danger. The lessons are about remote access, old systems and independent safety limits.

What is the sourced timeline?

Facts differ a little between sources, so each is attributed.

• 5 February 2021: CISA's advisory AA21-042A says threat actors obtained unauthorized access to the SCADA system of a US drinking water treatment facility on this date. The advisory does not name the town.
• 8 February 2021: Pinellas County Sheriff Bob Gualtieri announced the incident at a press conference. The Register reported that an operator saw activity early in the morning and assumed a supervisor was responsible. Hours later the cursor moved on its own.
• The change: The Register reports the intruder raised sodium hydroxide from 100 parts per million to 11,100 parts per million over several minutes, then left. The operator set it back and told a supervisor. Reports describe the software as TeamViewer on a plant computer. Hunton Andrews Kurth quotes the sheriff saying the access was meant to let authorized users troubleshoot from other locations.
• Public safety: Officials said it would have taken more than a day for affected water to reach the public and that other safeguards would have caught it.
• Investigation: The FBI and Secret Service were involved. At the time officials had no suspect and did not know why the town was targeted. CISA's advisory adds that the FBI could not confirm the incident began with a targeted intrusion, and that weak passwords and an outdated operating system were likely entry factors. It also says early information suggested desktop sharing software such as TeamViewer may have been used, and that this was not confirmed.

We have not found a primary source for details such as a shared password, so we leave them out.

Why was the damage limited?

A human was watching. The operator saw the cursor move and reversed the setting. That is a detection control that worked. Officials also said further safeguards existed downstream.

What did CISA recommend?

The advisory lists general steps: use a supported operating system, enable multi factor authentication, use strong credentials for remote desktop, audit networks for remote desktop use and close unused ports, log login attempts, audit logs for remote connection protocols, and train people to report social engineering. For water systems it recommends independent cyber physical safety systems that prevent dangerous conditions even if the control system is compromised, for example by limiting chemical pump or reservoir size. For TeamViewer it advises turning off unattended access, setting the service to manual start, requiring host confirmation for anything beyond view only and using the allow and block list.

What does this mean for software teams?

Remote support tools are software you installed and then forgot. The same inventory habit you apply to libraries applies here. Which remote access tools run on production and operations machines, which versions, who can connect and is every session logged? Operating system end of life matters too. CISA notes Windows 7 support ended on 14 January 2020, and the advisory flags an outdated operating system as a likely factor.

What to do

1. List every remote access tool on operational machines, including ones installed by contractors.
2. Turn off unattended access where it is not needed, and require a person on site to approve sessions.
3. Put multi factor authentication in front of every remote path.
4. Retire unsupported operating systems or isolate them from the internet.
5. Log remote sessions and review the log on a schedule.
6. Where a setting can cause physical harm, add a limit that software cannot override, such as a hardware or independent control.
7. Rehearse what an operator does when the cursor moves by itself.

Quick check

Sources

• CISA Advisory AA21-042A
• The Register, 9 February 2021
• Hunton Andrews Kurth: Florida water hack shows danger of remote access vulnerabilities

Last reviewed: 18 October 2026.