Recent attacks against U.S. water and wastewater systems have put a spotlight on exposed operational technology – PLCs (programmable logic controllers) and HMIs (human-machine interfaces) reachable from the public internet, still running default passwords. That’s a real problem, and CISA has said so directly.
But it’s not the only one. SpyCloud researchers collated a target database of 66,845 EPA-registered drinking-water and wastewater systems and completed a record-level identity analysis on 10,000 of those organizations, spanning utilities, and the ICS/OT and water-technology vendors that supply them. What we found: identity exposure runs through this sector on its own track – separate from, but just as urgent as, the OT risk making headlines.
Key takeaways
- SpyCloud found saved logins tied to roughly 167 U.S. utility metering tenants on a single infected device at an advanced-metering technology provider – one vendor endpoint, many downstream customers.
- Stolen session cookies, not just passwords, are showing up in water-sector exposure. Adversary-in-the-middle (AitM) attacks capture the session after MFA succeeds, so a password reset alone won't close the exposure.
- Direct utility findings cluster on remote-administration tools – TeamViewer, LogMeIn, GoToMyPC, SonicWall and Fortinet management portals – captured from municipal staff devices, not on plant equipment itself.
- The July 2026 Minnesota water-system incidents look like an OT story: SpyCloud found almost no stolen-credential foothold tied to the named victims, pointing instead to exposed PLCs.
- Identity exposure and OT exposure are two separate attack surfaces. Closing one doesn't close the other, and both need dedicated controls.
What we measured across the U.S. water sector
SpyCloud researchers built a target database of 66,845 EPA-registered drinking-water and wastewater systems, resolved those to 18,706 organizational internet domains, then added a curated list of the ICS/OT and water-technology vendors that supply the sector. We ran record-level analysis on 10,000 of those organizations against SpyCloud’s recaptured identity data – more than 1 trillion assets pulled from infostealer malware, successful phishes, breaches, and other criminal-underground sources.
The numbers:
organizations showed active infostealer exposure
carried credentials to OT or remote-access systems
turned up in active phishing or business email compromise targeting.
Getting there meant reviewing 523,572 infostealer-sourced records across 76,367 infected devices – a figure we collapsed by content signature first, since the same stolen log often gets rebroadcast under multiple machine IDs and would otherwise overstate reach. We also suppressed 29 consumer-webmail and malformed domains and manually validated every automated OT and government keyword flag, because an employee’s personal account turning up in a search doesn’t mean their employer’s systems are exposed.
Exposure concentrated in larger operators and in the vendor supply chain; small utilities were largely underrepresented. That’s a pattern in the data, not a claim that every water system nationwide carries this risk – and it measures identity exposure, not confirmed intrusion.
One infected vendor endpoint exposed 167 utility portals
The clearest example of shared third-party risk in this research: one device belonging to a major U.S. advanced-metering technology provider had been hit with information-stealing malware that exfiltrated saved logins for roughly 167 individual utility metering portals.
That finding doesn’t tell us whether those 167 logins still work, whether the accounts carry privileged access, or whether anyone has used them. Those are the next questions – for the vendor, and for any utility that runs on its metering platform. Answering them means confirming which exposed logins map to which tenant, checking what those accounts can do, and reviewing authentication logs for anything that looks like misuse. Cleaning the infected device stops the bleeding; it doesn’t undo the data that already left it.
Stolen sessions beat MFA – and change the remediation math
SpyCloud also found telemetry consistent with an active adversary-in-the-middle (AitM) identity compromise at a water-treatment technology and services provider. The February 2026 data included valid Microsoft 365 authentication information alongside material tied to bypassing MFA.
AitM phishing doesn’t try to beat multi-factor authentication head-on. It sits an attacker-controlled proxy between the user and the real login page, lets the user complete MFA normally, then captures the session cookie that comes out the other end. From there, the attacker can replay that session and act as the user for as long as it stays valid – no password guessing required.
That’s the shift worth paying attention to: stolen session data has overtaken passwords as attackers’ top target. A password reset doesn’t touch a stolen session. Closing this kind of exposure means revoking the session, invalidating the token, and checking what the account did while it was compromised – and most organizations don’t yet have the visibility or automated workflows to do that at scale.
To be clear about what this finding does and doesn’t show: it doesn’t establish that the compromised identity was used to reach a customer or operational environment. It shows an active identity compromise in progress.
Remote-access tools, not plant equipment, dominate direct utility findings
Among the utilities themselves, the pattern looked different: credentials for remote-administration and edge tooling – TeamViewer, LogMeIn, GoToMyPC, and SonicWall and Fortinet management portals – lifted from municipal staff devices. One small water district ran a shared “scada@” mailbox with a saved remote-desktop credential sitting exposed on an infected machine.
CISA, the FBI, the EPA, and NSA have flagged this exact category before. AA21-287A told water utilities to secure and monitor RDP. A dedicated CISA/EPA fact sheet urged hardening remote access to internet-exposed HMIs. A 30 July 2026 CISA alert on PLC-targeting activity told operators to allowlist remote access to known engineering laptops only. SpyCloud’s data shows credentials for exactly that class of tooling already sitting in criminal hands.
An account name or product label tells you where to look, not what to do. A TeamViewer credential to a laptop that’s already been reimaged is a non-issue; the same credential attached to an account with live administrative access is not. Our research didn’t focus on OT devices themselves, and none of this exposure should be read as exposure of specific industrial assets – it’s the identity layer sitting next to them.
Minnesota looks like an OT story, not an identity one
A coordinated cyberattack hit more than 30 Minnesota community water systems on July 26 and 27, 2026. State officials pointed to remotely accessible operational technology in most confirmed cases; the investigation is ongoing and no actor has been publicly attributed, though U.S. officials have indicated a probable Iran nexus.
We checked our dataset against the named victims and found almost no stolen-credential foothold. Based on that absence, we assess that stolen identity data was unlikely to be the primary way in – the available evidence points toward internet-exposed operational technology, including PLCs running default passwords, as the more likely path. CISA’s subsequent warning about a jump in PLC targeting in the water sector, and the FBI and EPA’s reporting of related activity starting July 27, are consistent with that read.
Worth saying plainly: this isn’t us downplaying identity risk in the sector. It’s a case where the evidence in our own data points somewhere else in this particular example, and we’re reporting that instead of forcing a narrative.
Two attack surfaces, two sets of controls
| Attack surface | What it's made of | What exposes it |
|---|---|---|
| Direct OT exposure | PLCs, HMIs, industrial equipment | Public internet reachability, weak or default credentials |
| Identity exposure | Passwords, session cookies, authentication tokens | Infostealer malware, phishing, third-party breaches |
Fixing one doesn’t fix the other. Pulling an HMI off the public internet doesn’t invalidate a vendor’s stolen session. Revoking a compromised corporate session doesn’t patch a PLC still running its default password. Both need their own controls, run in parallel.
This research doesn’t tie the exposure we found to a specific threat actor or nation-state campaign, and we’re not making that claim. Exposed identity data circulating in criminal marketplaces is available to whoever wants to buy or find it. The response should follow what the evidence shows about actual access, not assumption-based.
What to do next
Critical Infrastructure organizations like water and waste water utilities should be evolving their identity security program. By leveraging automated monitoring of exposed identities tied to your utility and its vendors, you don’t have to rely on a manual review that can’t keep pace with the volume of recaptured data now circulating. Next, confirm which flagged records are actually yours, map what those accounts can access, and prioritize anything with remote-administration or privileged access. Pair endpoint cleanup with credential rotation and session invalidation where the evidence calls for it. Lastly, check authentication logs to see whether identity exposure turned into weaponized use by a bad actor with a robust investigation.
Separately, inventory what’s internet-facing on the OT side and cut remote access down to what’s actually needed. Neither list replaces the other.
The bottom line
Our findings at the time of publishing don’t prove a water utility has been breached. What they show is that the identity exposure sitting around this sector – a vendor’s infected laptop, a stolen session, a saved remote-desktop password – is real, current, and largely invisible to the utilities it puts at risk. The Minnesota incidents show why that distinction matters: SpyCloud’s data pointed toward exposed OT there, not stolen identities, and it would have been easy to assume otherwise. Getting the two attack surfaces confused, in either direction, means fixing the wrong thing.
Water-sector security has to hold both stories at once. Direct OT exposure gets fixed by taking equipment off the public internet and killing default passwords. Identity exposure gets fixed by finding out what’s already been stolen and closing those specific paths before someone uses them. Neither one is optional, and neither substitutes for the other.
See how SpyCloud helps enterprises prevent costly cyber threats by illuminating and remediating identity exposures before attackers strike.
FAQs
Saved logins associated with approximately 167 U.S. utility metering tenants on one infected device at an advanced-metering technology provider – a single compromised vendor endpoint exposing identity intelligence tied to many customer organizations.
Of 10,000 organizations analyzed, 1,787 showed active infostealer exposure, 258 carried credentials to OT or remote-access systems, and 263 appeared in active phishing or business-email-compromise targeting.
AitM places an attacker-controlled proxy between a user and a legitimate service to capture the session cookie after the user completes MFA, letting the attacker resume the authenticated session without ever defeating the MFA challenge itself.
Because AitM attacks steal the session created after successful login, not the password. Closing the exposure means revoking the session, invalidating the token, and reviewing what the account did while compromised.
Credentials for TeamViewer, LogMeIn, GoToMyPC, and SonicWall and Fortinet management portals – captured from municipal staff devices. One small water district had a shared “scada@” mailbox with an exposed remote-desktop credential on an infected machine.
No. Pulling an HMI off the public internet doesn’t invalidate a supplier’s stolen session, and revoking a compromised corporate session doesn’t fix a PLC running a default password. Both attack surfaces need distinct controls.
Confirm which exposed records are actually yours, map their permissions, and prioritize anything with remote-administration or privileged access before moving to credential rotation and session invalidation.
No. It shows a potential access path and a place to start investigating – not a confirmed intrusion. Confirming misuse requires checking the destination system, account status, and authentication logs.
Keep reading
