Someone Almost Poisoned a City’s Water — Through a Remote Desktop App
Every documented water system hack has exploited the same category of weakness: industrial networks with no real perimeter security, connected to the internet through tools that were never designed for critical infrastructure.
In 2021, an attacker remotely accessed the water treatment plant in Oldsmar, Florida and briefly increased the sodium hydroxide level to 111 times its normal concentration. A plant operator watching a shared screen noticed the cursor moving on its own and reversed it in time. The entry point was TeamViewer — a remote desktop application — running on a plant computer with no firewall between it and the internet.
That was four years ago. The 2026 threat landscape is significantly worse.
Water utilities, wastewater treatment plants, and industrial operators across the US are now facing coordinated campaigns from nation-state actors — specifically Iranian, Chinese, and Russian-linked groups — that CISA has documented targeting water and wastewater systems specifically. The vulnerabilities they exploit aren’t new. They’re the same ones that made Oldsmar possible: industrial networks treated as isolated when they’re actually connected, and connected through tools with no security enforcement sitting in front of them.
Hardware firewalls aren’t a luxury for critical infrastructure. After every water system hack investigation, they show up in the “what was missing” column. This guide explains why — and what the right hardware stack actually looks like.
Table of Contents
The Scale of Water System Cyber Attacks in 2026
Water system cyber attacks are no longer isolated incidents. They’re a documented, ongoing campaign.
CISA, the EPA, and the FBI issued a joint advisory in 2024 specifically warning water and wastewater sector operators about active threats from multiple nation-state actors. The advisory documented Iranian-linked actors targeting programmable logic controllers (PLCs) used in water treatment systems, Chinese-linked actors pre-positioning inside US critical infrastructure for potential future disruption, and Russian-linked groups targeting water utilities alongside energy and transportation.
The Oldsmar incident in 2021 was the most publicized, but it wasn’t isolated. CISA has documented multiple additional incidents at US water utilities between 2021 and 2025 that received less public attention — some discovered quickly, others only after extended access.
⚠️ ALERT: The EPA issued an enforcement alert in 2024 warning that cybersecurity inspections of water systems found critical vulnerabilities in the majority of systems inspected — including default credentials on internet-facing systems, no network segmentation between IT and operational technology networks, and remote access tools with no multi-factor authentication. These are exactly the gaps that every documented water system hack has exploited. Read CISA’s water sector cybersecurity advisory (opens in new tab)
The threat isn’t theoretical and the targets aren’t limited to major metropolitan water systems. Small municipal water utilities — serving communities of a few thousand people — have been targeted specifically because they have the smallest security teams and the least security investment. An attacker looking for a foothold in US critical infrastructure finds small utilities far easier to compromise than large city systems with dedicated cybersecurity staff.
Why Water System Hacks Keep Happening — The Network Reality
Every water system hack investigation produces the same findings. The vulnerabilities are well-known, the fixes are available, and the attacks keep succeeding for the same documented reasons.
Remote Access Without Security
Water utilities need remote access for legitimate reasons — operators monitoring systems from home, vendors accessing equipment for maintenance, engineers checking readings from multiple sites. The problem is how that remote access gets implemented. TeamViewer, VNC, and direct RDP connections with no firewall enforcement, no MFA, and often with default or shared credentials represent the exact attack surface that Oldsmar demonstrated.
IT and OT Networks on the Same Flat Network
Operational Technology (OT) — the PLCs, SCADA systems, and industrial controllers that actually operate the water treatment equipment — frequently sits on the same network as the business IT systems. When an attacker compromises a business email account or an employee’s workstation, that flat network gives them a direct path to the operational systems that control chemical dosing and water flow.
Legacy Industrial Equipment With No Security Capabilities
Many PLCs and industrial controllers running in water utilities are 10-20 years old. They were designed before cybersecurity was a consideration and have no authentication capabilities, no logging, and no ability to run security software. Security has to be applied at the network layer — specifically at the hardware firewall sitting in front of these devices — because it can’t be applied on the device itself.
TYPICAL WATER UTILITY NETWORK — HOW ATTACKS ENTER
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Internet
│
▼
[No perimeter firewall / consumer router]
│
▼
Flat business network
│ ← Attacker moves freely
├── Office computers, email, files
├── Vendor remote access (TeamViewer/RDP)
├── SCADA workstations
└── PLCs controlling chemical dosing,
pumps, valves — no authentication
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
WHAT IT SHOULD LOOK LIKE:
Internet
│
▼
[Hardware Firewall — IPS, DPI, threat intelligence]
│
├── IT Network (VLAN 10) — office, email
│ └── Firewall rules block access to OT
│
└── OT Network (VLAN 20) — PLCs, SCADA
└── Firewall rules: whitelist only,
no direct internet access,
all vendor access through VPN
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━🔴 WARNING: A PLC controlling chemical dosing in a water treatment plant has no username, no password, and no ability to log who sends it commands. If an attacker reaches it on the network, they can send commands directly. The only thing preventing that access is what sits between the internet and that PLC on the network. If the answer is “nothing” or “a consumer router,” the Oldsmar scenario can repeat anywhere that network exists. Read NIST’s OT security guidance (opens in new tab)
What a Water System Hack Actually Looks Like
Understanding the documented attack sequence makes the hardware requirements concrete.
The Oldsmar Attack (2021) — Documented Entry and Execution
Attackers gained access through TeamViewer, which was installed on a plant computer and reachable from the internet with no enforced authentication beyond TeamViewer’s own credentials. Once connected, they used the mouse to navigate to the SCADA interface controlling chemical levels and changed the sodium hydroxide setting from 100 parts per million to 11,100 parts per million — a level that would cause serious harm to anyone consuming the water.
An operator watching the shared screen caught the change. The alert was human, not technological. There was no IPS, no anomaly detection, no network-level monitoring to catch the unauthorized SCADA command.
The Kansas Water Treatment Plant Attack (2021)
A former employee used credentials that had never been revoked to log into the water treatment plant’s systems and attempted to disrupt operations. No MFA. No access logging that triggered real-time alerts. No hardware firewall that would have enforced access controls based on the time of access, location, or device.
IRGC-Affiliated Actors on Water Utility PLCs (2023-2024)
CISA documented Iranian-linked actors specifically targeting Unitronics PLCs used in multiple US water utilities — accessing them through internet-exposed remote access with default credentials. Multiple utilities were affected. The PLCs displayed a message and their interfaces were defaced, but the concern was the access itself — the same access used for defacement could have been used for operational disruption.
Why Hardware Firewalls Are Essential After Every Water System Hack
Every post-incident investigation of a water system hack points to the same missing layer: a hardware firewall with real enforcement capability sitting at the network perimeter and between IT and OT network segments.
A hardware firewall in an industrial context does things that software solutions and consumer routers cannot:
Enforces Network Segmentation Between IT and OT
A properly configured hardware firewall creates a hard boundary between the business IT network and the operational technology network. Traffic between segments requires explicit rules. By default, nothing crosses. An attacker who compromises a business workstation cannot reach PLCs unless a firewall rule specifically permits that traffic — and the right answer is that no such rule should exist.
Blocks Direct Internet Access to SCADA and PLCs
Industrial controllers should never have direct internet access. A hardware firewall enforces this with outbound blocking rules that prevent SCADA workstations and PLCs from initiating or receiving direct internet connections. All legitimate remote access routes through a VPN with MFA enforcement.
Detects Anomalous Industrial Protocol Traffic
Modern hardware firewalls with OT-aware IPS signatures specifically detect anomalous Modbus, DNP3, and other industrial protocol traffic — the protocols water utility PLCs use. Unexpected commands, unusual timing, or traffic from unauthorized sources trigger alerts that give operators time to respond before damage occurs.
Logs Everything for Forensics and Compliance
Water utilities now face increasing regulatory requirements for security logging. A hardware firewall provides comprehensive, exportable logs of all network traffic — who accessed what, when, from where, and what commands were sent. This logging is what investigators use to reconstruct a water system hack after the fact, and what regulators increasingly require as evidence of security controls.
Hardware firewall options suited for industrial and utility environments — including Fortinet FortiGate with OT security features and SonicWall with industrial IPS capabilities — are available at jazzcybershield.com/firewalls. These aren’t consumer devices — they’re purpose-built security appliances that enforce the segmentation industrial networks require.
IT vs OT Networks: The Security Gap That Gets Utilities Hacked
The IT/OT convergence problem is the root cause of most water system hacks. Understanding it is essential to understanding why hardware firewalls matter so specifically.
IT Network characteristics:
- Regular patch cycles
- Modern operating systems with security capabilities
- Antivirus, EDR, logging all possible at the endpoint level
- Short hardware refresh cycles
- Designed to be connected
OT Network characteristics:
- Decades-long hardware lifecycles
- Legacy operating systems (Windows XP still running in some utilities)
- No endpoint security possible on PLCs and controllers
- Cannot be patched without extended maintenance windows
- Originally designed to be isolated — now connected for monitoring efficiency
| Security Layer | IT Network | OT Network |
|---|---|---|
| Endpoint security | ✅ Possible | ❌ Not possible on PLCs |
| OS patching | ✅ Regular cycles | ❌ Rare, complex |
| Authentication on devices | ✅ Standard | ❌ Often none |
| Logging on devices | ✅ Standard | ❌ Limited/none |
| Network-layer firewall | ✅ Effective | ✅ Only viable layer |
The table makes the critical point clear: network-layer hardware firewall enforcement is the only security control that works for OT devices. You cannot run antivirus on a PLC. You cannot add MFA to a 15-year-old Modbus controller. You can only control what network access reaches it — and that control lives entirely in the hardware firewall.
The Right Hardware Stack for Industrial Network Security
What does adequate protection for a water utility or industrial operator actually look like in hardware terms?
Layer 1: Perimeter Firewall
A next-generation hardware firewall at the internet boundary with:
- Deep packet inspection for all inbound and outbound traffic
- Intrusion prevention system with OT-specific signatures
- VPN enforcement for all remote access
- SSL inspection to catch encrypted threats
- Live threat intelligence feeds covering industrial threat actors
Layer 2: IT/OT Segmentation Firewall or VLAN Enforcement
A firewall or managed switch with VLAN enforcement between IT and OT network segments, with rules that default to deny and require explicit whitelist rules for any cross-segment traffic. The default posture is: OT devices cannot be reached from IT, and IT devices cannot reach OT.
Layer 3: OT Network Internal Segmentation
Within the OT network itself, further segmentation separating different operational functions. The chemical dosing PLC should not be reachable from the pump control system unless there’s a specific operational requirement for that communication.
Layer 4: Secure Remote Access Gateway
A dedicated VPN gateway requiring MFA for all remote access, with logging of every session. No direct remote desktop connections to operational systems — all remote access routes through the VPN with enforced authentication.
Layer 5: Network Monitoring
Network monitoring that detects anomalous traffic patterns within the OT network — unexpected command volumes, new devices appearing, traffic at unusual hours, or communication to unknown external destinations.
For industrial operators and utilities evaluating hardware options, Fortinet’s FortiGate lineup includes models with OT-specific security features — FortiGuard ICS/SCADA signatures, OT protocol inspection, and Security Fabric integration that provides unified visibility across IT and OT network segments.
What Regulators Now Require After Recent Water System Hacks
The water system hack incidents of recent years have accelerated regulatory action. Understanding what’s required — or coming — helps utilities prioritize their security investments.
EPA Cybersecurity Enforcement (2024)
The EPA issued enforcement alerts and guidance requiring water systems serving more than 3,300 people to conduct cybersecurity assessments and address identified vulnerabilities. Systems found without basic controls — network segmentation, MFA on remote access, current firmware — face compliance findings.
America’s Water Infrastructure Act
Requires community water systems to assess cybersecurity risks and vulnerabilities as part of risk and resilience assessments. Updated guidance specifically references network security controls.
CISA’s Cross-Sector Cybersecurity Performance Goals
CISA published Cybersecurity Performance Goals that apply across critical infrastructure sectors including water. These goals explicitly include hardware firewall deployment, network segmentation, and MFA on remote access as baseline controls.
The regulatory direction is consistent: hardware firewalls, network segmentation, and MFA are moving from best practice to compliance requirement for water utilities.
How to Protect Industrial Networks: Step-by-Step
- Map every network connection to your OT systems — Before you can protect it, you need to know what’s connected. Document every device, every network path, and every remote access method that touches your operational systems.
- Deploy a hardware firewall at the internet perimeter — Replace any consumer router or unmanaged connection at your network edge with a next-generation hardware firewall with IPS and threat intelligence capabilities.
- Segment IT and OT onto separate VLANs — No device on the IT network should be able to reach OT systems without explicit firewall permission. The default rule is deny.
- Eliminate direct remote access to OT systems — Remove TeamViewer, direct RDP, and any other tool that provides internet-facing access to operational systems. Replace with a VPN gateway requiring MFA.
- Enforce MFA on all remote access — Every person accessing your systems remotely — employees, vendors, contractors — authenticates through MFA. Shared credentials without MFA are gone.
- Block direct internet access from OT systems — OT devices and SCADA workstations should not be able to initiate outbound internet connections. Block this at the firewall level.
- Change all default credentials — Every device on your network: workstations, HMIs, firewalls, switches, routers, remote access tools. Default credentials are in public databases that attackers query during reconnaissance.
- Enable comprehensive logging — Hardware firewall logging captures every connection attempt, every cross-segment traffic flow, and every remote access session. Configure alerts for anomalous events.
- Conduct a vendor access audit — List every vendor with remote access to your systems. Verify they’re using MFA. Revoke access for vendors who no longer need it.
- Subscribe to CISA water sector alerts — CISA publishes sector-specific advisories when active campaigns target water utilities. Being notified the same day a campaign is identified gives you the response window that Oldsmar didn’t have.
Quick Reference Checklist
WATER UTILITY / INDUSTRIAL NETWORK SECURITY CHECKLIST
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
PERIMETER SECURITY
[ ] Next-gen hardware firewall deployed at internet edge
[ ] IPS with OT/ICS signatures enabled
[ ] All traffic logged — inbound and outbound
[ ] SSL inspection enabled
[ ] Live threat intelligence feeds active
NETWORK SEGMENTATION
[ ] IT and OT networks on separate VLANs
[ ] Firewall rules: OT not reachable from IT by default
[ ] OT devices cannot initiate internet connections
[ ] Further segmentation within OT network
[ ] Cross-segment rules documented and reviewed quarterly
REMOTE ACCESS
[ ] Direct TeamViewer / VNC / RDP to OT systems removed
[ ] All remote access through VPN with MFA
[ ] Vendor access individually provisioned (no shared creds)
[ ] Vendor access revoked when no longer needed
[ ] All remote sessions logged
CREDENTIALS
[ ] Default credentials changed on all devices
[ ] No shared passwords across systems
[ ] Password manager or PAM system in use
[ ] Privileged access accounts reviewed quarterly
MONITORING & RESPONSE
[ ] Network anomaly alerts configured
[ ] CISA water sector advisory subscription active
[ ] Incident response plan documented
[ ] Regulatory assessment completed
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━Frequently Asked Questions
Q: Are small water utilities really targeted by sophisticated attackers?
A: Yes — and specifically so. CISA has documented that small water utilities are preferred targets because they have weaker defenses and smaller security teams than large city water systems. The Iranian-linked attacks on Unitronics PLCs in 2023 specifically hit small and mid-sized water utilities across multiple states. Size doesn’t protect you; it makes you a softer target.
Q: Can a consumer router work for a small water utility if properly configured?
A: No. Consumer routers lack the IPS signatures, threat intelligence feeds, proper VLAN enforcement, and logging capabilities that industrial network security requires. A properly configured consumer router closes some misconfigurations — but it cannot detect anomalous industrial protocol traffic, cannot inspect encrypted threats, and does not provide the audit logging that regulators now require. Hardware-grade security is the minimum baseline for any network connected to operational technology.
Q: How much does it cost to properly secure a small water utility’s network?
A: A hardware firewall suitable for a small utility starts around $400-800 for entry-level FortiGate or SonicWall appliances, plus annual subscription for threat intelligence and IPS updates. Managed switches to enforce VLANs add another $200-600. A VPN gateway is often included in the firewall hardware. Total hardware investment is typically $1,000-2,500 for a small utility — a fraction of the cost of an incident response engagement after a water system hack.
Q: What’s the biggest mistake water utilities make in their network security?
A: Assuming OT isolation that doesn’t exist. Almost every water system hack investigation finds that the operational technology network was believed to be isolated from the internet — but wasn’t, because of a remote access tool, a vendor connection, or a network change that wasn’t fully documented. The first step is always an accurate network map that shows every actual connection, not what was assumed to exist.
Q: Does network segmentation alone protect OT systems?
A: Segmentation is necessary but not sufficient. You need segmentation (to limit what reaches OT), a hardware firewall enforcing those segments (to actually prevent unauthorized crossing), MFA on all remote access (to prevent credential-based bypass of the segmentation), logging (to detect if something is crossing segments that shouldn’t be), and current firmware on all devices (to close known vulnerabilities). Each layer closes gaps the others can’t close alone.
Conclusion
The Oldsmar water system hack in 2021 was preventable with a hardware firewall, network segmentation, and MFA on remote access. The Iranian attacks on US water utility PLCs in 2023 were preventable with those same controls plus default credential changes. Every documented water system hack investigation concludes with the same list of missing controls — controls that hardware firewalls sit at the center of.
These aren’t exotic security requirements. They’re the baseline network security posture that any organization connected to the internet should maintain. The reason water system hacks keep happening isn’t that the attacks are unsolvable — it’s that industrial operators continue to run operational technology on networks that lack the enforcement capabilities to stop documented, well-understood attack techniques.
Hardware firewalls, network segmentation, and MFA make a water system hack significantly harder to execute and significantly easier to detect when it’s attempted. For utilities and industrial operators ready to close these gaps, see the hardware options at jazzcybershield.com/firewalls — purpose-built security appliances that provide the enforcement layer industrial networks need.
Related Reading
- Why Small Businesses Close After a Cyberattack
- VLAN for Home Network 2026: Complete Setup Guide
- Router Settings You Must Change Right Now
- How Ransomware Actually Works and How to Never Pay the Ransom
- How Hackers Break Into Security Cameras
