SpyCloud says infostealer malware exposed remote-access and OT credentials at 1,787 U.S. water and wastewater organizations

Updated: 2026.09.25 25D ago 1 sources

Breaches & Data Leaks Malware Surveillance & Privacy

SpyCloud found stolen credentials linked to U.S. water and wastewater utilities and their technology suppliers, including logins that could help attackers reach operational systems. The company analyzed identity data tied to 10,000 utilities and vendors and reported active infostealer exposure at 1,787 organizations, with OT and remote-access credentials present at 258. In one case, a single infected device at an advanced metering vendor held saved logins for about 167 utility metering portals; exposed access also included TeamViewer and SonicWall and Fortinet management portals.

Why it matters: This is not just a theoretical weakness: stolen passwords can provide a direct path into water-sector systems that communities depend on. Utilities and vendors should reset exposed credentials, audit remote-access tools, enforce multi-factor authentication, and check endpoints for infostealer infections.

Sources

In Other News: Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, Water Utility Exposure

SecurityWeek News 2026.09.25 100% relevant

This article provides the concrete findings that establish a new sector-wide exposure story centered on infostealer-compromised credentials in the U.S. water sector.