Archive — US — techcrunch
Stolen passwords are exposing America’s water providers to hackers
A cybersecurity study reveals over 1,700 U.S. water and wastewater providers are vulnerable to hacks via malware that steals passwords and session tokens. This highlights the ease of compromising critical infrastructure. Although highly concerning, recent Iran-linked hacks did not exploit stolen passwords, indicating a need for stronger cybersecurity measures in this sector.
Key points
- Study by SpyCloud found 1,787 U.S. water organizations vulnerable to hacks due to stolen passwords.
- Password-stealing malware can bypass multi-factor authentication by stealing session tokens.
- At least 250 organizations had credentials exposed that could access operational networks.
- A specific breach allowed access to passwords for 167 utility companies through a compromised metering tech provider.
- Recent hacks attributed to Iran-backed hackers do not appear to use stolen passwords, highlighting varied cybersecurity threats.
Why it matters
- The article relates to 2025 IT trends emphasizing cybersecurity in critical infrastructure as indispensable.
- Increasing cyber threats against critical services like water also reflect growing concerns matched with government cybersecurity initiatives.
- The findings parallel historical trends where security weaknesses in critical infrastructures have led to significant breaches.
As cyber threats escalate, especially against critical infrastructure, enhancing security protocols and addressing password vulnerabilities is essential to safeguard vital public resources.