The incident took place Friday when an operator noticed the intrusion and watched the hacker access the system remotely. The hacker adjusted the level of sodium hydroxide to more than 100 times its normal levels, according to Pinellas County Sheriff Bob Gualtieri.
The operator immediately reduced the level back. At no time was there a significant adverse effect to the city’s water supply, and the public was never in danger, Gualtieri said. It is unknown if the breach happened from someone locally, nationally or even outside of the United States.
“This is somebody who is trying, as it appears on the surface, to do something bad. It’s a bad act. It’s a bad actor,” Gualtieri said. “This isn’t just ‘Oh — we’re putting a little bit of chlorine — or a little bit of fluoride, or a little bit of something,’ we’re basically talking about lye that you are taking form 100 parts per million to 11,100.”
Early intervention prevented the attack from having more serious consequences, said Robert M. Lee, the CEO of Dragos Inc., an industrial cybersecurity company. But, he said, this type of attack is precisely what keeps industry experts awake at night.
“It was not particularly sophisticated, but it’s exactly what folks worry about and as one of a very few examples of someone making an attempt to hurt people, it’s a big deal for that reason,” Lee said.
Gualtieri said it would have taken 24-36 hours for the water to reach the system and that there are several redundancies in place that would have alerted that the levels were too high before that happened. The city has taken steps to prevent further access into the system.
The Pinellas County Sheriff’s office, FBI and Secret Service are investigating the breach, Gualtieri said. FBI Tampa is working with the city of Oldsmar and the Pinellas County Sheriff’s Office, offering resources and assistance in the investigation of this incident.
CNN has reached out to the Secret Service for comment.
Sodium Hydroxide, also known as lye, is the main ingredient in liquid drain cleaner, Gualtieri said.
Long-term effects of poisoning depend on how fast the poison is diluted or neutralized in the system. Damage to the esophagus and stomach can continue to occur for several weeks after the poison was swallowed. Death can occur as long as a month later.
It is unknown if the increased levels in Oldsmar would have led to any of these symptoms.
Oldsmar, a city made up of about 15,000 people in Pinellas County, is about 17 miles west of Tampa.
CNN’s Rishi Iyengar and Brian Fung contributed to this report.