Password-stealing malware exposes more than 1,700 US water utilities to hackers

A study published on September 22, 2026 by cybersecurity company SpyCloud showed that more than a thousand water and wastewater treatment utilities in the United States are exposed to breaches because of malware capable of stealing passwords and active employee login sessions. The findings, reported by TechCrunch, reinforce something any security team dealing with critical infrastructure already knows in theory but rarely sees quantified: compromising an industrial system doesn't require generative AI or a sophisticated exploit. A stolen password is enough.

The scale of the problem, in numbers

SpyCloud built a database with more than 66,000 publicly registered access systems listed with the EPA (the U.S. environmental agency), belonging to roughly 10,000 organizations in the water sector. Running that universe against credential databases leaked by infostealers, the company found stolen passwords and credentials from 1,787 organizations, or nearly two in every ten utilities analyzed. In at least 250 of them, the exposed credentials appeared to grant direct access to operational networks and remote access systems, that is, to the layer that physically controls pumps and water flow.

One of the cases cited in the report is emblematic of supply-chain risk: an unidentified metering technology vendor had a single device on its own network infected by infostealer malware. That device leaked a large volume of credentials, including passwords for 167 US water utilities that relied on that vendor's technology. Jason Lancaster, SpyCloud's director of investigations, summarized the effect: a single breach "gave criminals the keys to access a hundred organizations with no relationship to one another whatsoever."

Why a stolen password is different from an exploited vulnerability

Infostealers are a type of malware that has existed for years and doesn't rely on any new technique: it infects a machine, usually via phishing or pirated software, and extracts everything saved in browsers and clients, including passwords and the session cookies that keep the user logged in. It's this second point that matters for anyone building authentication: a stolen session token lets the attacker log in as if they were the legitimate user, often bypassing MFA entirely, because the session already passed the second-factor check before being hijacked. These tokens then circulate in markets and channels where ransomware groups and initial access brokers buy and sell credentials by organization, sector, or system type.

It's worth separating this from the wave of attacks on US water utilities in recent weeks, which American authorities have linked to Iran-backed groups. SpyCloud itself says it found no evidence that these specific attacks used stolen passwords: the vector there appears to be another chronic problem in the sector, factory-default passwords on mechanical switches and physical controllers used in critical infrastructure, the same warning CISA had already been issuing. These are two parallel and equally basic problems: one is a configuration failure (a default password never changed), the other is a credential hygiene failure (a password stolen by malware on some machine). Lancaster sums it up: the water sector "has to hold both stories at the same time."

What this means for those operating SCADA in Brazil

The source doesn't provide data on Brazilian utilities, and there is no public survey equivalent to SpyCloud's for sanitation in Brazil. But the risk architecture described isn't an American peculiarity: it's structural in any water, energy, or sanitation system that depends on remote access to OT (operational technology) networks and on third-party telemetry, metering, or automation vendors, which describes practically any state sanitation company or water utility in the country.

The metering vendor case is the most relevant one for architects and infrastructure teams here, because it doesn't depend on the water utility's own security: it depends on the vendor's security. If a Brazilian utility uses third-party telemetry, RTUs (remote terminal units) monitored by an external partner, or any maintenance VPN operated by an integrator, the attack surface includes that partner's security hygiene, not just its own. This changes the question security teams should ask in a vendor audit: it's not just "do you have MFA," it's "how do you handle infostealer infections on the endpoints of whoever has access to the client's operational network."

In practice, this points to some concrete measures that make sense for anyone administering OT/ICS networks in Brazil, inside or outside the sanitation sector:

• Continuously monitor for credential leaks, not just react to incidents: there are threat intelligence services (SpyCloud itself is one, but there are alternatives) that track infostealer databases and alert when a corporate credential turns up compromised.
• Revoke the session, not just change the password: since the theft includes session cookies, forcing a global logout and invalidating active tokens is a mandatory part of responding to a detected infostealer, something many security policies still treat as optional.
• Truly segment the IT network from the OT network: the report stresses that the 250 most exposed organizations had credentials granting access to remote control systems. If the administrative network (where the malware that steals email passwords runs) has a direct path to the network that controls pumps and valves, segmentation has failed.
• Treat third-party access as your own attack surface: contractually audit the security posture of any telemetry, metering, or automation vendor with access to the operational network, with the right to evidence of controls, not just a declaration.

The most uncomfortable point in SpyCloud's report isn't the number of compromised utilities, it's that none of these breaches required exploiting a zero-day vulnerability or offensive AI. It was ordinary phishing, ordinary malware, credentials leaked on an ordinary market. For anyone building or auditing critical infrastructure systems in Brazil, that's the reminder that the cheapest security investment, monitoring for leaked credentials and revoking sessions quickly, is still what's most lacking in most environments.