Muleshoe is a town of about 9,000 people in the Texas panhandle. In January 2024 its water tank overflowed for somewhere between 30 and 45 minutes before staff noticed and switched to manual control.

Nobody drilled a hole in a pipe. A group affiliated with Russian military intelligence logged into the remote access software that came with the town's SCADA system, using credentials that had never been changed from the manufacturer's default.

Why this matters more than a bigger story would

When a large city gets attacked, small districts tend to read it as somebody else's problem. Muleshoe removes that comfort. The attackers did not choose Muleshoe because it was important. They chose it because the login worked.

Being small does not make you a low-value target. It makes you a low-effort one.

Three months later, a separate group posted video of themselves inside the control screens of several other Texas water utilities, adjusting settings while recording. Those utilities had something in common: shared remote access software supplied by a vendor.

The pattern to look for in your own district

In every one of these cases, the way in was remote access — not a clever exploit. The questions worth asking at your district are simple:

  • Who can reach our SCADA system from outside the plant, and from what devices?
  • Has every default password shipped with our equipment been changed?
  • Does remote access require a second factor, or just a password?
  • If our operator manages other districts, does one login reach all of them?
  • Would we know within an hour that a level reading had been changed remotely?

That last question is the one most small districts cannot answer. The Muleshoe overflow ran for up to 45 minutes before a person noticed. Nothing detected it — someone happened to look.

The shared-operator problem

Many Houston-area MUDs are run by contract operators who manage dozens or hundreds of districts on one platform. That is efficient, and it is usually good for reliability. It also means a single compromised vendor credential can touch every district in the portfolio at the same time. This is not hypothetical — it is exactly what the April 2024 Texas incidents demonstrated.

If you are a board member, this is a fair question to put to your operator in open session, and a reasonable one to expect a written answer to.

What it costs to fix

Changing default credentials and turning on multi-factor authentication for remote access costs almost nothing but attention. Segmenting the control network, adding logging, and getting someone to actually watch it costs real money — and that is the part federal and state grant programs are designed to pay for.