Drowning in Default Passwords: 30+ US Water Systems Hacked in Coordinated Attack

More than 30 water systems in Minnesota were hit by a coordinated cyberattack after hackers exploited default passwords and internet-connected operational technology [215598]. The attack targeted systems managing water treatment and distribution, which are part of the state’s critical infrastructure [215598].

The method was simple but effective: many industrial control systems still use factory-set passwords that are never changed, and the hackers found these systems online and accessed them directly [215598]. The incident serves as a clear warning about how vulnerable public utilities are when basic security steps are ignored [215598].

Local leaders are urged to act immediately by changing every default password on connected devices, auditing which systems are linked to the internet, requiring multi-factor authentication for remote access, creating rapid response plans, and training staff to spot suspicious activity [215598]. The Minnesota attack is not an isolated event but part of a pattern, as water systems across the country face the same risks [215598]. The fix is not expensive, but it requires immediate attention—delaying action leaves the door open for the next attack [215598].