The main news in the media about hackers often portray them as petty criminals to earn quick money or as unconscious agents working under the command of some nefarious organization or government. Often, the effects of their actions range from comic annoyances to frightening invasions of privacy, but only a few have been found to be potentially fatal on a large scale. Unfortunately, that was almost the reality that citizens of Oldsmar, Florida, faced when a hacker tried to poison the entire city with water supplies.
It was Friday morning when an employee at the city’s water treatment plant noticed his computer’s mouse cursor moving by itself. Familiar with the normal use of remote access by authorized personnel, the employee did not care until the operator noticed the same incident in the late afternoon, this time using remote access to increase the amount of sodium hydroxide or caustic soda in the water. 100 parts per million to 11,100 parts. Caustic soda is used to regulate the pH balance of drinking water in small quantities and is toxic to humans at higher levels.
The worst case scenario, fortunately, did not occur because the operator quickly returned to normal levels before it could have any effect. Even if so much bleach leaked, the plant’s redundant systems would have alerted them to such a situation and it would take 24 to 36 hours before the contaminated water reached the city population.
Despite this, the incident caused great concern on the part of local and federal authorities. This is perhaps one of the few cases of a publicly reported hacking incident intended to cause physical harm rather than just stealing data. Last year, there were reports of a ransomware attack indirectly resulting in the death of a German woman due to the delay, although the real cause was later clarified as unrelated.
Authorities are still investigating the incident and have yet to determine whether the attack was carried out locally, nationally or even outside the country. Senator Marco Rubio (R-FL) has asked the FBI for help and wants it to be treated as a national security issue.