Summary

SpyCloud says its analysis of 10,000 U.S. water-sector organisations found exposed credentials, session data and remote-access accounts across utilities and technology vendors. The findings describe potential identity attack paths, not confirmed intrusions into the systems analysed.

SpyCloud says an analysis of the U.S. water sector found stolen credentials, session data and remote-access accounts connected to utilities and the technology vendors that supply them. The company describes these findings as identity exposure: potential paths for account misuse that are separate from, but related to, direct attacks on industrial equipment.

The research is based on SpyCloud’s commercial database of recaptured criminal data. It identifies exposed identities and credentials, rather than confirming that a particular utility was breached.

Contents

What SpyCloud measured

SpyCloud researchers built a target database of 66,845 EPA-registered drinking-water and wastewater systems. They resolved those systems to 18,706 organisational internet domains and added a curated list of water-technology and industrial-control-system vendors. Record-level analysis was then performed on 10,000 organisations using SpyCloud’s recaptured identity data, which the company says contains more than 1 trillion assets collected from infostealer malware, successful phishing, breaches and other criminal-underground sources.

Among the organisations analysed, 1,787 showed active infostealer exposure, 258 had credentials connected to operational-technology or remote-access systems, and 263 appeared in active phishing or business-email-compromise targeting. The researchers reviewed 523,572 infostealer-sourced records across 76,367 infected devices. They first grouped duplicate records by content signature and manually checked automated flags to reduce false matches, such as an employee’s personal account being mistaken for an organisational exposure.

SpyCloud says exposure was concentrated among larger operators and in the vendor supply chain, while small utilities were underrepresented in the dataset. That makes the figures a measure of observed exposure in the analysed sample, not a prevalence estimate for every U.S. water system.

How the identity exposure works

One example involved a device at a U.S. advanced-metering technology provider. SpyCloud says information-stealing malware extracted saved logins associated with approximately 167 individual utility metering tenants from that single endpoint. A vendor device can therefore become a source of account information linked to many otherwise separate customer organisations.

The finding does not show whether those logins remained valid, had privileged permissions or were used. SpyCloud says utilities and the vendor would need to identify the affected tenants, determine account permissions and review authentication logs to establish whether misuse occurred.

The research also identified data consistent with an adversary-in-the-middle, or AitM, compromise at a water-treatment technology and services provider. In this type of phishing attack, an attacker-controlled proxy sits between the user and the legitimate login service. The user can complete multi-factor authentication normally, while the attacker captures the authenticated session cookie created afterwards.

A stolen session can allow an attacker to act through the user’s active session without guessing the password or defeating the MFA prompt directly. SpyCloud says February 2026 data from the provider included valid Microsoft 365 authentication information and material associated with bypassing MFA. Responding to this type of exposure requires session revocation and token invalidation alongside password changes, followed by a review of account activity.

Direct utility findings centred on remote-administration tools and network-management portals, including TeamViewer, LogMeIn, GoToMyPC, SonicWall and Fortinet. The credentials were captured from municipal staff devices rather than from the water-plant equipment itself. In one small water district, SpyCloud found a shared scada@ mailbox with a saved remote-desktop credential on an infected machine.

Why identity and operational technology need separate controls

Water-sector systems face at least two distinct attack surfaces. The operational-technology surface includes programmable logic controllers, human-machine interfaces and other industrial equipment exposed through internet connectivity or weak and default passwords. The identity surface includes passwords, session cookies and authentication tokens stolen through infostealer malware, phishing or third-party compromise.

SpyCloud’s comparison with the Minnesota water-system incidents of July 26 and 27, 2026 illustrates the distinction. The company found almost no stolen-credential foothold connected to the named victims and assessed that stolen identity data was unlikely to have been the primary route in those cases. Its analysis instead pointed towards internet-exposed operational technology, including PLCs using default passwords.

SpyCloud recommends addressing the two surfaces in parallel. For identity exposure, utilities should confirm which records belong to them, map account permissions, prioritise remote-administration and privileged accounts, rotate affected credentials, invalidate compromised sessions and inspect authentication logs. Separately, they should inventory internet-facing operational technology and restrict remote access to what is necessary.

Removing an HMI from the public internet does not revoke a stolen vendor session, just as closing a compromised corporate account does not repair a PLC still using a default password. The research’s central finding is that both paths can exist around the same water system and require different security controls.

Sources