From: PopSci

The Illinois Statewide Terrorism and Intelligence Center released a “Public Water District Cyber Intrusion” report on November 10 that indicates that hackers may have had access to the system since September. Hackers using Russian IP addresses hacked the software vendor that makes the system. They were then able to access the vendor’s database of usernames and passwords, and used the stolen credentials for remote access to the SCADA system’s network. These vendors keep records of their customer’s access information for maintenance and upgrading the systems.

Two to three months before the discovery of the hack, operators noticed “glitches” in the remote access to the SCADA system. “They just figured it’s part of the normal instability of the system,” said Joe Weiss, cybersecurity expert and managing partner at Applied Control Solutions, who obtained a copy of the report. “But it wasn’t until the SCADA system actually turned on and off that they realized something was wrong.”