Someone tried to poison a Florida city by hacking into the water treatment system, sheriff says

A hacker gained access into the water treatment system of Oldsmar, Florida, on Friday and tried to increase the levels of sodium hydroxide — commonly referred to as lye — in the city’s water, officials said, putting thousands at risk of being poisoned.

The incident took place Friday when an operator noticed the intrusion and watched the hacker access the system remotely. The hacker adjusted the level of sodium hydroxide to more than 100 times its normal levels, according to Pinellas County Sheriff Bob Gualtieri.

The operator immediately reduced the level back. At no time was there a significant adverse effect to the city’s water supply, and the public was never in danger, Gualtieri said. It is unknown if the breach happened from someone locally, nationally or even outside of the United States.

“This is somebody who is trying, as it appears on the surface, to do something bad. It’s a bad act. It’s a bad actor,” Gualtieri said. “This isn’t just ‘Oh, we’re putting a little bit of chlorine or a little bit of fluoride, or a little bit of something,’ we’re basically talking about lye that you are taking from 100 parts per million to 11,100.”

Early intervention prevented the attack from having more serious consequences, said Robert M. Lee, the CEO of Dragos Inc., an industrial cybersecurity company. But, he said, this type of attack is precisely what keeps industry experts awake at night.

“It was not particularly sophisticated, but it’s exactly what folks worry about and as one of a very few examples of someone making an attempt to hurt people, it’s a big deal for that reason,” Lee said.

Gualtieri said it would have taken 24-36 hours for the water to reach the system and that there are several redundancies in place that would have alerted that the levels were too high before that happened. The city has taken steps to prevent further access into the system.

The Pinellas County Sheriff’s Office, FBI and Secret Service are jointly investigating the breach, Gualtieri said. The FBI’s field office in Tampa is working with Oldsmar and the sheriff’s office, offering resources and assistance in the investigation.

CNN has reached out to the Secret Service for comment.

Florida Sen. Marco Rubio wants the hacking of the water treatment system handled as a national security measure, he tweeted Monday.

“I will be asking the @FBI to provide all assistance necessary in investigating an attempt to poison the water supply of a #Florida city,” the tweet read. “This should be treated as a matter of national security.”

Sodium hydroxide, also known as lye, is the main ingredient in liquid drain cleaner, Gualtieri said.

Symptoms of sodium hydroxide poisoning include breathing difficulties, lung inflammation, throat swelling, burning of the esophagus and stomach, severe abdominal pain, vision loss, and low blood pressure, according to the University of Florida Health System.

Long-term effects of poisoning depend on how fast the poison is diluted or neutralized in the system. Damage to the esophagus and stomach can continue to occur for several weeks after the poison was swallowed. Death can occur as long as a month later.

It is unknown if the increased levels in Oldsmar would have led to any of these symptoms.

Oldsmar, a city made up of about 15,000 people in Pinellas County, is about 17 miles west of Tampa.