SpyCloud Study Finds Infostealer Data Exposed at 1,787 Water Organizations
Summary
SpyCloud analyzed 10,000 water and wastewater organizations and found active infostealer exposure at 1,787. The study identified credentials tied to OT or remote-access systems at 258 organizations, but measured identity exposure—not confirmed intrusions.
Key points
- SpyCloud examined 10,000 organizations from a database of 66,845 EPA-registered systems; 1,787 showed active infostealer exposure.
- A device infected with an infostealer at an unnamed smart-meter provider held saved logins linked to about 167 utility metering tenants, according to SpyCloud.
- The study found that 258 organizations with active exposure had credentials for operational technology or remote-access systems.
- SpyCloud said stolen credentials and session cookies may enable access to email and VPNs, including by hijacking authenticated sessions to bypass multifactor authentication.
- The report measured identity exposure, not confirmed intrusions, and did not assess exposure of specific OT devices.
- Exposure was concentrated among larger operators and vendors; small utilities were underrepresented, and SpyCloud had no cross-industry comparison.
- SpyCloud said it began a responsible disclosure process, starting with a briefing for CISA.
Article Details
- Publisher
- CyberScoop
- Scope
- SpyCloud study of infostealer identity-data exposure among U.S. water and wastewater organizations.
- Sample Size
- 10,000 organizations analyzed from a database of 66,845 EPA-registered systems.
- Key Statistics
- 1,787 of 10,000 analyzed organizations showed active infostealer exposure.
- 258 organizations with active exposure had credentials for operational technology or remote-access systems.
- One infected device at an unnamed smart meter technology provider exposed logins linked to approximately 167 U.S. utility metering tenants.