A hacker tried to poison a Florida city by remotely accessing the water treatment system, police say

An unidentified hacker gained access to a panel that controls the water treatment system of Oldsmar, Florida, on Friday and tried to drastically increase the levels of sodium hydroxide in the water supply, officials from Pinellas County announced this week. According to CNN, Pinellas County Sheriff Bob Gualtieri said in a press conference Monday that the intrusion was noticed by a legitimate operator who watched the hacker access the system remotely and adjust the level of sodium hydroxide—commonly referred to as lye—to more than 100 times its normal levels. The operator quickly reduced the level back, saving thousands from the risk of being poisoned.

"The hacker changed the sodium hydroxide from about one hundred parts per million to 11,100 parts per million," Gualtieri said in the press conference, adding that these were "dangerous" levels. According to VICE, when asked if the incident should be considered an attempt at bioterrorism, the sheriff said: "What it is is someone hacked into the system not just once but twice... opened the program and changed the levels from 100 to 11,100 parts per million with a caustic substance. So, you label it however you want, those are the facts."

Sodium hydroxide can be deadly if ingested in large amounts and can cause severe skin burns and eye damage in smaller quantities. However, Gualtieri assured that the public was never in danger as at no time was there a significant adverse effect on the city's water supply. "The person remotely accessed the system for about three to five minutes, opening various functions on the screen," Gualtieri said during the press conference. "One of the functions opened by the person hacking into the system was one that controls the amount of sodium hydroxide in the water."

At 8 a.m. Friday, a plant operator at the Oldmar's water treatment facility noticed someone remotely accessing the system that he was monitoring, the sheriff revealed. The system was deliberately set up with a piece of remote access software so that "authorized users could troubleshoot system problems from other locations," he added. Although the initial attempt to gain remote access was brief, the hacker reportedly did it again at 1:30 p.m. and changed the sodium hydroxide levels at the time. "The intruder exited the system, and the plant operator immediately reduced the level back to the appropriate amount of one hundred," Gualtieri said, adding that steps were taken to "stop further remote access to the system" and that there are other safeguards in place to protect the water integrity.

The County Sheriff's office has started a criminal investigation into the incident along with the FBI and the Secret Service. "This is somebody who is trying, as it appears on the surface, to do something bad. It's a bad act. It's a bad actor," Gualtieri said. "This isn't just 'Oh, we're putting a little bit of chlorine or a little bit of fluoride, or a little bit of something,' we're basically talking about lye that you are taking from 100 parts per million to 11,100." Robert M. Lee, the CEO of Dragos Inc.—an industrial cybersecurity company—said that while early intervention prevented the attack from having more serious consequences, this type of attack is precisely what keeps industry experts awake at night.

"It was not particularly sophisticated, but it's exactly what folks worry about and as one of a very few examples of someone making an attempt to hurt people, it's a big deal for that reason," Lee said. Florida Sen. Marco Rubio tweeted Monday that he wants the hacking of the water treatment system handled as a national security measure. "I will be asking the @FBI to provide all assistance necessary in investigating an attempt to poison the water supply of a #Florida city," the tweet read. "This should be treated as a matter of national security."