TWO small private water utilities in Colorado were targeted by foreign hackers in late August, according to the state governor’s office. The utilities, which each serve fewer than 200 people, were not identified, and neither were the attackers. The intrusions involved changes to equipment settings, pumping cycles, remote access and alarms. Officials said the incidents were brief, were contained by the providers and did not affect water services, drinking-water quality, treatment processes or public safety.
Colorado officials have referred to the attackers as “foreign actors”, but have not confirmed an Iranian connection. A spokeswoman for Governor Jared Polis said authorities were aware of nationwide efforts by an Iranian-backed group to access water and wastewater systems, while stressing that there was no confirmation the Colorado incidents formed part of that campaign. The available evidence also does not establish a link with attacks reported at water facilities in at least a dozen US states in July.
The incidents have renewed concern about exposed operational technology at smaller utilities. The Cybersecurity and Infrastructure Security Agency (CISA) said many systems involved in July attacks were internet-connected programmable logic controllers (PLCs), sometimes linked through cellular modems without a firewall or gateway. Attackers reportedly accessed exposed PLCs remotely, changing addresses and passwords and disabling shutdown processes or alarms.
CISA urged utilities to identify and secure exposed PLCs, removing remote access where unnecessary and protecting it where required. Since fiscal year 2025, the Environmental Protection Agency has identified more than 900 vulnerabilities across over 650 water systems.