Foreign hackers targeted two Colorado water utilities' control systems, state says

Hackers described only as "foreign actors" targeted the operational technology systems of two small private water utilities in Colorado in late August, changing equipment settings and disabling alarms in incidents that did not affect water services or public safety, Colorado Gov. Jared Polis’s office said.

Ally Sullivan, a spokeswoman for Polis, said the incidents involved individuals changing equipment settings, disabling remote access and alarms, and altering pumping cycles. "These were brief incidents, and the risks were quickly addressed by the providers themselves, who subsequently alerted the state," Sullivan said. The governor’s office has not identified the affected utilities, which serve fewer than 200 people combined, or named the attackers.

Sullivan said the state cannot confirm which foreign actors may have been involved, but said officials are aware of ongoing efforts nationwide by an Iranian-backed group to access drinking water and wastewater systems, citing information from the Cybersecurity and Infrastructure Security Agency. Despite that reference, there is no confirmation that the Colorado utilities were targeted as part of a broader campaign that hit water facilities in at least a dozen states in July, including confirmed targets in Minnesota, Michigan, Alabama, Georgia, New Jersey, South Dakota and Wisconsin. Federal authorities have not published a complete list of affected utilities, and available evidence does not currently establish a direct link between those July attacks and the Colorado incidents.

CISA said more than 100 internet-exposed systems in the U.S. water and wastewater sector were hit by cyberattacks in July. The agency published exposure-reduction guidance on Aug. 21 explaining how utilities can identify their own internet-facing weaknesses. CISA said most of the affected systems in the July attacks were programmable logic controllers, small industrial computers that control pumps and valves, many of which were connected directly to cellular modems without a firewall or gateway protecting them.

The agency said hackers remotely accessed exposed PLCs, changed device IP addresses and passwords, and in some cases disabled shutdown processes and alarms, creating unsafe conditions without notifying the operators running the equipment. Iran is the suspected actor behind much of the activity, likely tied to the broader conflict involving the U.S. and Israel, though officials have stopped short of formally attributing the attacks.

Since fiscal year 2025, the Environmental Protection Agency has identified more than 900 vulnerabilities across over 650 water systems and said it has helped address about 700 of them at more than 500 utilities, while also conducting more than 710 cybersecurity risk assessments and providing technical support to roughly 15,900 utilities.