Stolen Passwords Put U.S. Water Providers at Risk of Cyberattacks

SpyCloud Study Reveals Widespread Credential Theft

New cybersecurity research from SpyCloud shows that well over a thousand U.S. water and wastewater utilities are vulnerable to intrusion because malicious software is harvesting employee passwords and active session tokens, offering attackers an easy route into networks without the need for AI tools.

The investigators built a repository of more than 66,000 public‑facing systems registered with the U.S. Environmental Protection Agency, representing roughly 10,000 organizations. They detected password‑stealing malware in 1,787 of those entities—about one‑fifth of the sample—while at least 250 of those organizations had credentials that could grant access to operational networks and remote‑access platforms controlling pumps and water flow.

In one case, an unnamed metering technology provider had a compromised device on its network. The infection collected credentials for 167 utility companies that depend on that provider. SpyCloud’s Chief Investigations Officer, Jason Lancaster, said the breach effectively handed attackers the keys to “a hundred otherwise unrelated organizations.”

Password‑stealing programs, also called infostealers, capture stored passwords and the session tokens that keep users logged in, allowing attackers to impersonate legitimate users and often bypass multi‑factor authentication. Stolen credentials are routinely traded on underground markets to gain entry to specific targets.

Recent Hacks and the Dual Threat Landscape

The report arrives weeks after a series of attacks on water utilities across the country, which the U.S. government has privately tied to hackers backed by Iran. The findings also come amid a wave of attacks that have hit water supplies in dozens of communities across the United States.

SpyCloud found no evidence that the Iran‑linked breaches relied on stolen passwords; instead, they exploited manufacturer‑set default passwords in mechanical switches and physical controllers, echoing earlier warnings from the Cybersecurity and Infrastructure Security Agency (CISA)

While default credentials remain a known weakness in critical‑infrastructure equipment, the researchers stress that stolen passwords are a parallel, widely available avenue for anyone willing to purchase or locate them. Lancaster notes that the water sector must confront both narratives simultaneously.