Local and federal authorities are investigating an attempt to poison the city of Oldsmar’s water supply, Pinellas County Sheriff Bob Gualtieri said.
Someone remotely accessed a computer for the city’s water treatment system and briefly increased the amount of sodium hydroxide, also known as lye, by a factor of more than 100, Gualtieri told a news conference on Monday. The chemical is used in small amounts to control the acidity of water, but it is also a caustic compound commonly found in household cleaners, such as liquid drain cleaners.
The city’s water supply is not affected. A remote supervisor saw the concentration change on his computer screen, and immediately put it back, Gualtieri said. City officials stressed Monday that several other guarantees exist to prevent contaminated water in the water supply, and said they have eliminated the remote access system used in the attack.
The Pinellas County sheriff is investigating with the FBI and the Secret Service, Gualtieri said.
No arrests have been made, Gualtieri said, though investigators have some clues. They do not know why Oldsmar was targeted, he said. He added that municipalities in the area had been warned about the attack and were encouraged to investigate the guarantees for their water treatment systems and other infrastructure.
Although some cities supply water through Pinellas County, Oldsmar supplies water directly to its businesses and about 15,000 residents, Gualtieri said. The computer system at the water treatment plant is set up to give authorized remote users access to it for troubleshooting.
An operator of the factory monitored the system around 08:00 on Friday and noticed that someone had briefly gained access to it. He did not find it unusual, Gualtieri said, because his supervisor regularly accessed the system.
But around 1:30 p.m. the same day, Gualtieri said, someone had access to the system again. This time, he said, the operator saw someone take the mouse, send it to the software that controls the water treatment, work in it for three to five minutes, and increase the amount of sodium hydroxide from 100 parts per million to 11,100 parts. per million.
The attacker left the system, Gualtieri said, and the operator immediately changed the concentration back to 100 parts per million.
“There has never been a significant adverse effect on the water being treated,” the sheriff said. “It’s important that the public was never in danger.”
Even if the operator did not catch it, he said, it would have taken more than a day before the water entered the water supply.
“The protocols we have in place, monitors protocols, it works – that’s the good news,” said Oldsmar Mayor Eric Seidel. ‘Even if they did not catch them, there are violations in the system that would have caught the change in the pH level.
“The most important thing is to keep everyone informed,” he said. “There’s a bad actor.”
Senate Marco Rubio also addressed the attack in a tweet on Monday, saying it should be “treated as a matter of national security.”
The sheriff learned of the attack and began investigating Friday night, Gualtieri said. Investigators do not yet know if the attack originated inside or outside Pinellas County, Florida or the United States. If the attacker is apprehended, he said, they will face criminal charges and possibly federal charges.
Contact with sodium hydroxide can kill the skin and cause hair loss, according to the National Center for Biotechnology Information. Ingestion can be fatal.
Gualtieri said he did not know what physiological consequences the concentration of the attack would have. It was also not immediately clear if a similar attack had ever taken place in the US. In 2007, the water of a city in Massachusetts was accidentally treated with too much lye, causing burns and skin irritation among people who shower with it.
“I’m not a chemist,” Gualtieri said. “But I can tell you what I do know … if you throw the amount of dust in the drinking water, it’s not a good thing.”