Password-stealing malware leaves 1,787 US water providers exposed

The findings underscore how water providers and other critical infrastructure can be compromised with relative ease amid a wave of hacks targeting water supplies across dozens of U.S. communities. While password-stealing malware isn’t new, the research shows how stolen credentials give hackers an easy route into an organization’s network without using AI tools. SpyCloud built a database of more than 66,000 public-facing systems registered with the U.S. Environmental Protection Agency, spanning 10,000 organizations. It found password-stealing malware had swiped passwords and credentials from 1,787 of those organizations — nearly two in 10 providers checked. The firm said at least 250 organizations had exposed credentials that appeared to allow access to their operational networks and remote-access systems, which control physical pumps and water flows.

The analysis covered an unnamed metering technology provider that had a device on its network infected with password-stealing malware. That malware stole reams of credentials, including passwords for 167 U.S. utility companies that rely on the metering provider. SpyCloud chief investigations officer Jason Lancaster said the single breach handed criminals “the keys to access a hundred otherwise unrelated organizations.” Infostealer malware lets hackers steal a person’s stored passwords as well as the session tokens that keep them logged in — tokens that can let a hacker log in as the legitimate user and often bypass multi-factor authentication. Hackers regularly trade stolen credentials to obtain access to specific organizations.

The research comes weeks after a spate of hacks targeting U.S. water providers that the U.S. government has privately tied to Iran-backed hackers. SpyCloud said it found no evidence those Iran-linked hacks relied on stolen passwords; instead, the signs point to security weaknesses such as manufacturer-set default passwords in the mechanical switches and physical controllers used by critical infrastructure, echoing earlier findings from U.S. cybersecurity agency CISA. Rather, the researchers say stolen passwords are a separate, major source of access available to “whoever wants to buy or find it.” Lancaster said the water sector “has to hold both stories at once.”

Why it matters

The findings show two distinct but overlapping weaknesses — commodity credential theft and outdated hardware defaults — both leaving water infrastructure exposed, meaning a single fix like patching default passwords won’t close the gap.