The incident happened Friday, when an operator noticed the intrusion and watched the hacker access the system remotely. The hacker adjusted the sodium hydroxide level to more than 100 times normal levels, according to Pinellas County Sheriff Bob Gualtieri.
The operator immediately reduced the level back. At no time has there been a significant adverse effect on the city’s water supply and the public has never been in danger, said Gualtieri. It is not known whether the violation happened to someone locally, nationally or even outside the United States.
“It is someone who is trying, as it seems superficially, to do something bad. It is a bad act. He is a bad actor,” said Gualtieri. “This isn’t just ‘Oh – we’re putting in a little bit of chlorine – or a little bit of fluorine, or a little bit of something’, we’re basically talking about lye that you’re taking at 100 parts per million to 11,100.”
Early intervention prevented the attack from having more serious consequences, said Robert M. Lee, CEO of Dragos Inc., an industrial cybersecurity company. But, he said, this type of attack is precisely what keeps industry experts awake at night.
“It wasn’t particularly sophisticated, but that’s exactly what people care about and, as one of the few examples of someone trying to hurt people, it’s a big problem for that reason,” said Lee.
Gualtieri said it would take 24 to 36 hours for the water to reach the system and that there are several redundancies at the site that would have warned that the levels were too high before this happened. The city has taken steps to prevent further access to the system.
The Pinellas County sheriff’s office, the FBI and the secret service are investigating the violation, said Gualtieri. The FBI Tampa is working with the city of Oldsmar and the Pinellas County Sheriff’s Office, offering resources and assistance in investigating the incident.
CNN contacted the Secret Service for comment.
Sodium hydroxide, also known as caustic soda, is the main ingredient in liquid drain cleaner, said Gualtieri.
The long-term effects of poisoning depend on how quickly the poison is diluted or neutralized in the system. Damage to the esophagus and stomach can continue to occur for several weeks after ingesting the poison. Death can occur up to a month later.
It is not known whether increased levels of Oldsmar would have caused any of these symptoms.
Oldsmar, a town of about 15,000 in Pinellas County, is about 17 miles west of Tampa.
CNN’s Rishi Iyengar and Brian Fung contributed to this report.