Oldsmar’s disputed hack, undisputed weaknesses
Nobody could later prove whether an outsider or an employee changed Oldsmar’s chemical setting. That uncertainty was itself the finding: small utilities need evidence that can tell the two apart, safeguards that work whoever acts, and public statements that survive revision.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On February 8, 2021, the Pinellas County sheriff announced that on February 5 someone had remotely accessed the control system of the water treatment plant serving Oldsmar, Florida, a small city near Tampa. According to the public account, an operator watched the cursor move on his screen. The setting for sodium hydroxide, a chemical used to manage acidity, was raised from 100 parts per million to 11,100. He reversed it at once, and officials said the public was never at risk because of other safeguards.
Federal and state advisories in the following days described conditions common across the sector. Remote access software was installed on control system computers. A password was shared, an operating system was past the end of support, and the systems were connected to the internet without a firewall. The incident drew national attention to the security of small water utilities.
Oldsmar became shorthand for a frightening scenario: someone on the internet trying to poison a town’s water. In 2023 the city’s former manager said the event was more likely an employee’s mistake than an outside intrusion. Many people concluded the story had been overblown. A more useful conclusion is that two years on, nobody could show conclusively which version was true. A plant where several people share one remote access password, and where actions are not tied to individuals, cannot tell an error from an attack. Earlier in this series we looked at mapping control system connections, and later pieces cover who owns security at small utilities. Here we take three questions Oldsmar raised: what evidence a utility needs to know what happened, which safeguards work regardless of who acts, and how officials should speak before the facts are settled.
Evidence: telling an error from an intrusion
The advisories described remote desktop software on control system computers and a password shared among the people who used it. In that setup, the record of a session says that the shared account connected. It does not say who was behind it, or from where.
Three changes give a small utility the evidence it lacked:
- Individual accounts. Every operator, engineer and vendor technician signs in as themselves, with multifactor authentication for remote sessions. Turnover is a reason for this, not an obstacle, because shared passwords outlive the people who knew them.
- One remote access path. All remote sessions go through a single gateway that records who connected, from where and when, instead of through software installed on individual control computers.
- Logs kept off the plant network. Session records and changes to control settings are copied to a location an intruder on the plant network cannot alter, and kept for at least a year.
None of this requires replacing the control system. It does require someone to set it up, and in a utility with a handful of staff, that person may also be running the plant. Shared services help here. A county, a regional authority or a state program can provide a standard managed gateway and logging service that each small system joins, so no plant has to engineer its own.
There is a second benefit. Good evidence also protects staff. An operator accused of a mistake, or suspected of worse, is better served by a clear log than by an argument about what probably happened.
Safeguards that work whoever acts
Officials said the change would have been caught before it affected drinking water, by alarms, water quality monitoring and the time chemicals take to move through the system. The operator also noticed in real time. Human attention and engineered limits were the parts of the story that worked, and they work whether the person at the controls is an intruder, a careless employee or a confused one.
Those safeguards deserve the same deliberate design as the digital ones:
- Hard limits. Chemical dosing setpoints are bounded in equipment that cannot be overridden remotely, so no screen can command a dangerous value.
- Independent sensing. Water quality sensors and alarms that do not depend on the same computers as the controls, so a compromised workstation cannot hide what is happening.
- Confirmation for large changes. Procedures requiring a second person, or a local confirmation, before a setpoint moves beyond a normal range.
The method is to start from the dangerous outcome, here an unsafe chemical dose reaching customers, and work backward through every barrier that prevents it. Each barrier should be tested on a schedule, the way fire alarms are. The trade-off is operational: limits and confirmations slow legitimate adjustments, so operators need to help set the ranges.
Hygiene still matters. The advisories named an unsupported operating system and a direct internet connection. Where replacement takes years, isolating legacy machines from the internet and from business networks reduces exposure while the engineered barriers protect the public.
Communication before the facts are settled
The first announcement was made quickly, with confidence about what had happened. When that account was questioned two years later, the revision fed doubt about the whole issue of utility security, including the parts that were never in dispute.
Oldsmar’s incident was announced by the county sheriff, with city and state officials alongside. Several agencies speaking at once makes a confident early account more likely, because each wants to reassure the public. Agreeing in advance who leads public statements for a utility incident, and what they will and will not say in the first days, removes that pressure.
Officials facing an operational technology incident can protect credibility with a simple discipline. Say what is known, what is not yet known, and which protections worked. Describe the cause as under investigation until the evidence supports a conclusion. Commit to a follow-up statement. That restraint costs a day of headlines. It preserves trust for the next incident, which may be clearly malicious, and it is far easier when the utility holds logs that can settle the question.
With hindsight
In 2023 Oldsmar’s former city manager said publicly that the event was likely the result of an employee error. Whatever the cause, the conditions the advisories described were real, and later events showed they were widespread. In late 2023, actors linked by U.S. agencies to Iran’s government compromised internet-exposed industrial controllers at several U.S. water facilities, including one in Pennsylvania, often using default passwords. The EPA issued an enforcement alert on drinking water cybersecurity in 2024, and other water utilities reported incidents that year. The EPA’s earlier attempt to require cybersecurity review through sanitary surveys was withdrawn in 2023 after legal challenges.
By 2026 the gap between what small utilities need and what they can staff remains the central problem. Oldsmar’s lasting value is as a test any utility can apply to itself: if something changed a setpoint tonight, could you prove who did it?