The incident took place on Friday when an operator became aware of the intrusion and saw the hacker gain access to the system remotely. According to Pinellas County Sheriff Bob Gualtieri, the hacker adjusted the sodium hydroxide level to more than 100 times normal levels.
The operator immediately lowered the level. Gualtieri claimed that at no time did there be a significant adverse effect on the city’s water supply and the public was never in danger. It is unknown whether the breach occurred to anyone locally, nationally, or even outside the United States.
“It’s about someone trying, as it appears on the surface, to do something bad. It’s a bad act. It’s a bad actor,” Gualtieri said. “That’s not just ‘Oh – we’re putting in a little chlorine – or a little fluoride, or a little something,’ we’re basically talking about bleach that’s taking 100 parts per million to 11,100.”
Early intervention prevented the attack from having more serious consequences, said Robert M. Lee, CEO of Dragos Inc., an industrial cybersecurity company. But, he said, this type of attack is precisely what keeps industry experts awake at night.
“It wasn’t particularly sophisticated, but it’s exactly what worries people and, as one of the few examples of someone trying to hurt people, it’s something important for that reason,” Lee said.
Gualtieri said it would have taken 24-36 hours for the water to reach the system and that there are several layoffs that would have alerted the levels to be too high before this happened. The city has taken steps to prevent new access to the system.
The Pinellas County Sheriff’s Office, the FBI and the Secret Service are investigating the breach, Gualtieri said. The FBI Tampa is collaborating with the City of Oldsmar and the Pinellas County Sheriff’s Office, providing resources and assistance in investigating this incident.
CNN has contacted the secret service for comment.
Sodium hydroxide, also known as bleach, is the main ingredient in the liquid drain cleaner, Gualtieri said.
The long-term effects of poisoning depend on how quickly the poison is diluted or neutralized in the system. Damage to the esophagus and stomach can continue to occur for several weeks after ingestion of the poison. Death can occur up to a month later.
It is unknown whether the increase in levels in Oldsmar would have caused any of these symptoms.
Oldsmar, a city of about 15,000 people in Pinellas County, is about 17 miles west of Tampa.
CNN’s Rishi Iyengar and Brian Fung contributed to this report.