Attempt to poison water treatment plant was not a cyber incident
The attempt to poison a US water treatment plant in 2021 via a cyber attack probably turns out not to have been a cyber attack at all. After an investigation, the FBI concludes that there is no evidence for such a cyber incident.
It is not clear what happened at the Oldsmar water treatment plant in the US state of Florida. At the beginning of 2021, local media reported that an unknown hacker had broken into the ICT systems of the installation. The attacker would then have tried to gradually change the sodium hydroxide content in the water to adjust its acidity. The incident was widely publicized and is to this day cited by many cybersecurity experts as an example where a hack can have major physical consequences on infrastructure. Experts have been warning of such disaster scenarios for years and saw the Oldsmar incident as a confirmation of those warnings.
The story then became endorsed by various board members of the water treatment plant and by the local police who investigated. Many details came out from employees of the installation. For example, they would have seen how a mouse cursor suddenly started moving on screens.
It now appears that the incident was not a hack or other digital intrusion. The FBI, which later launched an investigation with the US Secret Service, said at a conference that ‘no evidence of outside access’ has been found. A former manager of the installation has also called the incident a ‘non-event’. The FBI suspects it was most likely the employee who initially reported the incident. That employee would have accidentally hit his or her keyboard incorrectly or pressed the wrong button and possibly wanted to shift the blame.
The FBI has not yet issued an official statement, but says against it the Tampa Bay Times that the investigation “cannot confirm that the incident resulted from a targeted cyber attack on Oldsmar.” It is not clear whether the investigation is still ongoing and why the FBI did not release the information sooner.