SpyCloud, Inc.

NTD's David Lam reports.

Cybersecurity company SpyCloud found that almost 1,800 organizations were exposed to potential hacks in its research of water and wastewater systems.

SpyCloud says there's malware capable of stealing employee passwords and logged-in sessions.

At least 250 organizations carried credentials that could allow access to their systems, which control pumps and water flows.

This comes as federal and state authorities investigate a series of cyberattacks targeting these facilities.

SpyCloud's chief investigations officer says, quote, "...the identity exposure sitting around this sector — a vendor's infected laptop, a stolen session, a saved remote desktop password — is real, current, and largely invisible to the utilities it puts at risk." SpyCloud says it found not only passwords but also stolen session cookies in its analysis, meaning a password reset alone won't be enough.

The stolen session cookies can allow a hacker to log in as if they were the actual users.

Recently, cyberattacks have targeted water providers around the United States.

Those findings, along with recommendations for improving national cyber resilience, will be published in a public after-action report.

Research from identity risk firm SpyCloud found that nearly eighteen percent of US water and wastewater organizations it analyzed had identity data actively exposed by info stealer malware.

Researchers examined ten thousand organizations and found over seventeen hundred with exposure involving stolen credentials, session cookies, or other authentication data.

The supply chain can magnify that risk.

In one case, a single infected device at a smart meter technology provider contained saved logins associated with roughly one hundred and sixty-seven utility customers.

SpyCloud also found that two hundred and fifty-eight affected organizations had credentials linked to operational technology or remote access systems.

The researchers stress that identity exposure doesn't mean an organization has been breached, and the study didn't examine exposed operational technology devices themselves.

Smaller utilities were also underrepresented.

This represents a major strategic threat to the intellectual property behind US artificial intelligence.

Non-human identities have become the leading entry point for corporate hackers, according to SpyCloud.

Attackers are increasingly abusing compromised service accounts and APIs to bypass perimeter defenses.

This shift means traditional password security is no longer sufficient for enterprise protection.