Stolen passwords are exposing America’s water providers to hackers

SpyCloud's research found that password‑stealing malware has compromised credentials for nearly 1,800 U.S. water and wastewater providers, including at least 250 sets of credentials that appear to grant access to operational and remote‑access systems; a single infected metering vendor exposed passwords for 167 utilities. The report warns that stolen passwords and session tokens (which can bypass MFA) are valuable to criminals and can be traded, increasing risk to critical infrastructure even as some recent water‑sector intrusions were linked to other weaknesses rather than credential theft.