Infostealer Malware Exposed Logins at Nearly 1,800 US Water Providers, SpyCloud Finds

Credential-stealing malware has collected employee logins from almost 1,800 US water and wastewater organizations, according to a report from SpyCloud.

Nearly One in Five Providers

SpyCloud analyzed roughly 10,000 organizations by reviewing more than 66,000 outward-facing systems registered with the US Environmental Protection Agency. Infostealer malware had harvested logins from 1,787 of them — nearly 20% of the providers surveyed.

Access to the Systems That Move Water

Credentials from at least 250 organizations looked capable of reaching operational networks and the remote-access tools used to run pumps and control water movement — the part of a utility where a breach has physical consequences.

One Laptop, 167 Utilities

A single infected device at an unnamed metering technology provider had collected passwords for 167 US utility companies — a stark example of how one vendor's compromise can expose many customers at once.

Why It Applies Beyond Utilities

Infostealers don't break in; they log in with real passwords taken from employees' and vendors' devices. Multi-factor authentication on every remote-access path, regular checks for leaked company credentials, and tight control over what vendor accounts can reach are the basic defenses for any business.