News

Stolen passwords are exposing America’s water providers to hackers

Published

2 months ago

September 22, 2026

New security research has found that well over a thousand U.S. water and wastewater providers are exposed to hacks due to malware that’s capable of stealing their employees’ passwords and active logged-in sessions.

The findings by cybersecurity defense firm SpyCloud underscore how water providers and other critical infrastructure can be compromised with relative ease amidst a wave of hacks targeting the water supplies of dozens of communities across the United States.

While password-stealing malware is not new, the research highlights how stolen passwords offer hackers an easy route to break into an organization’s network without using AI tools.

SpyCloud said it built a database of more than 66,000 public-facing systems that are registered with the U.S. Environmental Protection Agency, amounting to 10,000 organizations. The company found password-stealing malware had swiped passwords and credentials from 1,787 organizations, or nearly two in ten providers they checked. The firm noted at least 250 organizations had credentials exposed that appeared to allow access to their operational networks and remote-access systems, which control the physical pumps and water flows.

The analysis covered an unnamed metering tech provider, which had a device on its network that was infected with password-stealing malware. The malware stole reams of credentials, including passwords for 167 U.S. utility companies that rely on the metering tech provider.

SpyCloud chief investigations officer Jason Lancaster said in the post that this single breach handed criminals the keys to access “a hundred otherwise unrelated organizations.”

Password-stealing malware, also known as infostealers, allow hackers to steal a person’s stored passwords as well as the session tokens that are used to keep them logged in. These session tokens can allow a hacker to log in as if they were the legitimate user, and can often bypass multi-factor authentication systems. Hackers regularly trade stolen credentials in order to obtain passwords or session tokens for accessing specific organizations.

This research comes weeks after a spate of hacks targeting water providers around the United States, which the U.S. government has privately tied to Iran-backed hackers. SpyCloud said it found no evidence that those Iran-linked hacks relied on stolen passwords. In those cases, the signs point to security weaknesses, such as manufacturer-set default passwords, in the mechanical switches and physical controllers used by critical infrastructure, SpyCloud said, echoing earlier findings from U.S. cybersecurity agency CISA.

Rather, the researchers note that stolen passwords are a major source of access to “whoever wants to buy or find it,” in parallel to the known security risks with critical infrastructure tech. Lancaster said that the water-sector “has to hold both stories at once.”

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

Related Topics:Americas exposing Hackers passwords providers stolen Water

Up Next

Court set to hear suit on turf battle between ICAN, forensic fraud investigators institute

Don't Miss

2027: We’re bringing back fuel subsidy – Kwankwaso

Click to comment

News

NPFL: VAR Is Not A Luxury, Technology Is Taking Over – Avonda Richard

Published

26 minutes ago

November 7, 2026

PlateauReports

WhatsApp Image 2026 11 06 at 8.02.51 PM.jpeg

Avonda Richard, an ardent supporter of the Nigerian Premier Football League (NPFL) based in Ogba, Lagos State, has called for the introduction of Video Assistant Referee (VAR) technology in the domestic league, insisting that Nigeria must embrace modern football technology to improve officiating and strengthen the credibility of its football competitions.

Speaking during Sports247’s Let’s The Fans Talk programme, Richard expressed concerns over the standard of refereeing in Nigerian football, acknowledging the efforts of match officials while pointing out the challenges affecting their performance, particularly inadequate training and facilities.

“To be honest, the Nigerian officiating sometimes is really, really poor. But I must also give it to them; they are trying their best,” Richard said.

He argued that some referees lack the necessary professional training and access to adequate facilities to prepare them for the demands of the game, stressing that officiating should be treated as a serious profession that requires proper development and continuous education.

Richard maintained that introducing VAR into the NPFL would help reduce officiating errors and bring Nigerian football closer to the standards of other competitive leagues.

“VAR is not a luxury because technology is taking over. So VAR is something that Nigeria needs to introduce in the Nigerian Premier League,” he stated.

Beyond the introduction of technology, Richard also called for improved television coverage of the domestic league, noting that Nigerian football deserves greater visibility and should be accessible to supporters in the same way they follow major European competitions.

“We should be having a Nigerian professional league that people can watch, just like when we watch Premier League, Italy and Germany on the screen,” he added.

He believes that increased broadcast coverage would attract more attention to the NPFL, create greater awareness among football supporters and encourage accountability within the league.

Richard’s comments highlight the growing conversation around the need for improved refereeing standards, investment in modern technology and greater visibility for Nigerian football as the NPFL continues to seek stronger recognition within African football.

Business

CBN issues regulations for non-security virtual assets, effective November 5,

Published

1 hour ago

November 7, 2026

PlateauReports

BY NKECHI NAECHE-ESEZOBOR—The apex regulator, the Central Bank of Nigeria (CBN) on Friday issued regulations for the Operations of Non-Security Virtual Assets in Nigeria, setting out a framework for licensing, regulating and supervising stablecoins, virtual asset service providers and related activities.

According to a circular to virtual asset service providers and stakeholders in the financial services industry, the apex bank said the regulations are meant to promote responsible innovation, strengthen the integrity of the Nigerian financial system and provide an appropriate framework for emerging digital payment instruments.

The CBN said the regulations are issued under the CBN Act, 2007, the Banks and Other Financial Institutions Act, 2020, and other applicable laws. It described them as a comprehensive, risk-based framework covering the licensing, authorisation, regulation, supervision and oversight of non-security virtual assets in Nigeria.

The framework covers stablecoins, Deposit Money Tokens, virtual asset service providers, virtual asset payment services, platform-facilitated peer-to-peer services, and custody, transfer, remittance, clearing and settlement activities.

The regulations also set requirements on the classification and designation of regulated tokens and activities, and on the licensing of issuers and providers of non-security virtual asset services. Other areas covered include capital, reserve-backing, liquidity and redemption; corporate governance, risk management and internal controls; and technology risk, cybersecurity and operational resilience.

They further address the safeguarding of reserve and customer assets; customer protection, disclosures and complaints management; and anti-money laundering, counter-terrorist financing and counter-proliferation financing obligations. Sanctions screening, transaction monitoring, blockchain analytics, Travel Rule compliance, counterparty due diligence, regulatory reporting, supervisory access, information sharing, enforcement, administrative sanctions and orderly wind-down arrangements are also included.

The CBN said the regulations apply to persons carrying out regulated activities in or from Nigeria, those directing such activities at persons in Nigeria, and those whose activities may materially affect the country’s payments system, financial system, foreign exchange market or financial stability. They may apply whether or not the person has a physical presence in Nigeria.

The apex bank said the regulations do not displace the statutory mandate of the Securities and Exchange Commission or any other competent authority. Activities involving security virtual assets, securities, investment contracts or other capital-market products remain subject to the capital-market regulatory framework. Where an activity involves both non-security virtual assets and matters under another authority’s mandate, approvals must be obtained from each competent authority.

All affected institutions, issuers, service providers, operators, promoters and other stakeholders are required to familiarise themselves with the regulations and comply fully with the applicable requirements.

The regulations take effect from November 5, 2026. The circular was issued by the CBN’s Payments System Policy Department.

The post CBN issues regulations for non-security virtual assets, effective November 5, appeared first on Business Today NG.