The incident took place on Friday when an operator noticed the break-in and saw the hacker gain access to the system remotely. According to Pinellas County Sheriff Bob Gualtieri, the hacker adjusted the sodium hydroxide level to more than 100 times the normal level.
The operator immediately lowered the level back. At no point was there a significant adverse effect on the city’s water supply, and the public was never in danger, Gualtieri said. It is not known whether the breach was committed by anyone locally, nationally or even outside the United States.
“This is someone who, it seems at first glance, is trying to do something bad. It’s a bad act. It’s a bad actor,” said Gualtieri. “This isn’t just ‘Oh – we’re doing a little bit of chlorine – or a little bit of fluoride, or a little bit of’, we’re actually talking about lye that takes you from 100 parts per million to 11,100.”
Early intervention prevented the attack from having more serious consequences, said Robert M. Lee, the CEO of Dragos Inc., an industrial cybersecurity company. But, he said, these types of attacks are exactly what keeps industry experts up at night.
“It wasn’t particularly sophisticated, but it’s exactly what people are concerned about and as one of the few examples of someone trying to hurt people, it’s a big deal for that reason,” Lee said.
Gualtieri said it would have taken 24-36 hours for the water to reach the system and several redundancies were put in place that would have indicated the levels were too high for that to happen. The city has taken measures to prevent further access to the system.
The Pinellas County Sheriff’s office, the FBI and the Secret Service are investigating the breach, Gualtieri said. FBI Tampa is working with the City of Oldsmar and the Pinellas County Sheriff’s Office to provide resources and assistance in the investigation of this incident.
CNN has contacted the Secret Service for comment.
Sodium hydroxide, also known as lye, is the main ingredient in liquid drain cleaner, Gualtieri said.
Long-term effects of poisoning depend on how quickly the poison is diluted or neutralized in the system. Damage to the esophagus and stomach can continue for several weeks after swallowing the poison. Death can occur up to a month later.
It is not known whether the elevated levels in Oldsmar would have resulted in any of these symptoms.
Oldsmar, a town of about 15,000 residents in Pinellas County, is located about 17 miles west of Tampa.
CNN’s Rishi Iyengar and Brian Fung contributed to this report.