Because who doesn't love a good cybersecurity breach?
October 11, 2026
In a groundbreaking revelation that’s as surprising as finding out that water is wet, a new study has found that stolen passwords put over 1,700 U.S. water and wastewater providers at risk of being hacked. Thanks to SpyCloud (the saviors we didn’t know we needed), we now know that malware has compromised credentials for 1,787 organizations—nearly 20% of the ones studied. Apparently, basic credential theft is the new black, overshadowing those fancy AI exploits we keep hearing about.
SpyCloud took a deep dive into more than 66,000 public systems registered with the U.S. Environmental Protection Agency, covering about 10,000 water-related organizations. And guess what? They found that nearly 20% of these providers had their passwords swiped. How thrilling! But wait, it gets juicier: at least 250 of those organizations had credentials that could actually let hackers waltz right into their operational networks and control the waterworks—because why would you want to guard something so crucial?
Let’s talk about infostealer malware, the real villain of the piece. This sneaky little thing doesn’t just grab saved passwords; it also snatches active session tokens, allowing attackers to impersonate employees and potentially sidestep multi-factor authentication. It’s like the magic ticket that lets them into the club without showing ID. And if that’s not enough, these stolen credentials are freely traded in the underground market—like the latest trend in fashion, but with way more potential for catastrophe.
Oh, and there’s a delightful supply-chain risk involved too! SpyCloud uncovered an unnamed metering tech provider with an infected device. That tiny slip-up exposed credentials for 167 utility companies. Just one weak link in the vendor chain can unlock access to hundreds of water systems. It's like having a party where just one guest can let in everyone else—brilliant!
This report follows a series of cyberattacks on U.S. water providers allegedly linked to Iran-backed hackers. However, SpyCloud pointed out that those attacks didn’t use stolen passwords; they were more about default passwords and mechanical switches—because who doesn’t love leaving the front door wide open?
The bottom line? Water utilities need to get their act together. Strong password policies, multi-factor authentication, session-security controls, vendor monitoring, and actually removing default credentials are the bare minimum to protect essential services. Because at the end of the day, we wouldn’t want hackers playing with our water supply, would we?
