HACKERS targeted the operational technology (OT) systems of two private water utilities in Colorado in late August, apparently seeking to disrupt their operations. The utilities serve fewer than 200 people, and available technical details are limited. According to a spokesperson for Governor Jared Polis, the attackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles. The effects were brief, however, and did not disrupt water services or threaten public safety.
The governor’s office has not identified the utilities or the attackers, referring only to “foreign actors”. It said it could not confirm which foreign actors were involved, while noting that the Cybersecurity and Infrastructure Security Agency (CISA) has warned of an Iranian-backed group targeting drinking-water and wastewater systems. There is no confirmation that the Colorado incidents were connected to a campaign that targeted water-sector organisations in at least a dozen US states in July.
CISA said more than 100 internet-exposed water systems were targeted during that month, with confirmed victims including facilities in Minnesota, Michigan, Georgia, South Dakota, New Jersey, Wisconsin and Alabama. CISA has urged water-sector organisations to secure their OT environments in response.