New cybersecurity research indicates that identity security has become a central priority for the U.S. water sector. An analysis by SpyCloud found that stolen employee passwords and active login sessions could create potential access routes across numerous water and wastewater providers.
Credential Security Moves to the Forefront
The research reviewed more than 66,000 publicly accessible systems associated with around 10,000 organizations registered with the U.S. Environmental Protection Agency. According to the findings, credentials linked to 1,787 organizations had been captured by password-stealing malware.
At least 250 of these organizations were found to have exposed credentials that may be associated with operational networks or remote-access environments. These systems can support essential tasks such as monitoring equipment, managing pumps and coordinating water flow.
Why Session Tokens Matter
Known as infostealers, password-stealing programs can collect stored logins as well as session tokens. These tokens keep users signed in to online platforms and, if compromised, can enable unauthorized access that may bypass some multi-factor authentication protections.
The analysis also highlighted the connected nature of the sector. In one case involving a metering technology provider, compromised credentials reportedly included logins connected to 167 utility organizations. The finding illustrates how the security posture of shared technology partners can influence an entire service ecosystem.
For water providers, the study reinforces practical priorities: replacing default passwords, adopting phishing-resistant authentication, monitoring remote access, segmenting operational networks and rapidly revoking compromised sessions. Stronger identity controls can help utilities modernize securely while maintaining reliable public services.
As critical infrastructure becomes more connected, investment in digital resilience is likely to make water systems smarter, more efficient and better prepared for the future.
