In February 2021, officials in Pinellas County, Florida said a hacker had remotely accessed the City of Oldsmar's water treatment system and changed a sodium hydroxide setting. A staff member noticed and reversed it before the chemical levels in the water changed. The case is mainly a lesson about remote access and human oversight.
What was reported
On 8 February 2021 county officials announced that the intruder had accessed the system on two separate occasions. A law firm summary of the announcement says the intruder used preinstalled TeamViewer software, a common IT troubleshooting tool that the sheriff said was meant to let authorised users fix problems from other locations.
A water system staff member saw the altered setting and reversed it. The county moved to stop further remote access and called in the FBI and the Secret Service. We cite only that summary, so other details in news coverage, such as exact concentrations, are not repeated here.
Why this is a safety story
Sodium hydroxide is used in water treatment, and the concern in such a case is a control setting pushed outside a safe range. The protection that mattered here was not a firewall alert. It was a person looking at the screen and recognising something wrong.
That points to a design principle: critical settings deserve independent limits that software and remote users cannot override, such as a hard cap in the dosing equipment, plus alarms when values move.
Lessons the summary supports
The source does not list recommendations, so these are our reading of the events, not claims from it.
- Limit remote access tools on control systems. Remove them if there is no need, or restrict them to named users, strong authentication and approved times.
- Monitor for unauthorised changes to critical settings, and alert a human.
- Keep human verification of critical process values, and make sure operators are trained to challenge unexpected movement.
- Add engineered limits at the equipment, so a changed setpoint cannot reach a harmful value.
How it connects to other cases
The Ukrainian grid attack in 2015 also used remote access and stolen credentials to operate real equipment (summary). Joint government advice on tools aimed at industrial controllers asks for multi factor authentication on all remote access to control networks, as we summarise in our post on that advisory.
Continuous checks
Monitoring for drift in what is installed and exposed is part of the answer. Continuous monitoring in Safeguard watches the software you build and dependencies for new issues; it does not monitor plant control networks.
Click through it at your own pace, or open it full screen.
Quick check
Did the water become unsafe?
The source says a staff member reversed the change and that actual chemical levels did not change.
What tool did the intruder use?
The summary says preinstalled TeamViewer remote access software.
Sources
Last reviewed: 19 October 2026.
