A hacker gained access to the water treatment system for the city of Oldsmar, Florida, and attempted to increase the concentration of sodium hydroxide (NaOH), also known as lye and caustic soda, to extremely dangerous levels.

Sodium hydroxide is commonly found in household cleaners, but can be very dangerous if ingested in high concentrations. However, in lower levels it is used by water treatment facilities to adjust acidity (pH) and remove heavy metals.

Access via remote desktop software

The attack on the computer system at Oldsmar water treatment system happened on Friday at 1:30 PM, through a remote desktop software that allowed authorized users to troubleshoot system problems remotely.

The hackers remotely gained access to a software program, named TeamViewer, on the computer of an employee at the facility to gain control of other systems, sheriff Bob Gualtieri said in an interview with Reuters.

A plant operator said that they observed how someone took control of the mouse and used it to make changes in the software that controls the functions for the city’s water treatment.

The intruder spent between three to five minutes inside the system and changed the the sodium hydroxide level from 100 parts per million to 11,100 parts per million.

The change was immediately reverted by the operator and the population of Oldsmar was not at risk at any moment because the operator intervened immediately. The plant operator then cut off remote access to the system.

Eric Seidel, the mayor of the city, said that Oldsmar water treatment system is set up with redundancies that would have sounded an alarm if the water’s chemical levels reached dangerous levels.

“Even if the plant operator had not quickly reversed the increased amount of sodium hydroxide, it would have taken between 24 and 36 hours for that water to hit the water supply system and there are redundancies in place where the water had been checked before it would have been released” – Sheriff Bob Gualtieri

Gualtieri added that there has been no arrest and there is no information on whether the breach originated from the U.S. or outside the country. The Pinellas County Sheriff’s Office, the FBI, and the Secret Service are investigating the incident.