Foreign actors broke into the computer systems of two Colorado water utilities last month, altering pumping cycles, disabling alarms and changing equipment settings before operators regained control, state officials said Thursday.
Gov. Jared Polis’ office said the intrusions did not affect drinking water quality or treatment processes. The affected systems serve roughly 400 people.
“These were brief incidents, and the risks were quickly addressed by the providers themselves, who subsequently alerted the state,” said Eric Maruyama, a spokesman for Polis.
According to the governor’s office, the hackers altered equipment settings, disabled remote access and alarms, and changed pumping cycles. State officials have not identified who was behind the breaches or said whether they are linked to similar attacks reported elsewhere in the country.
The incidents add Colorado to a growing list of states dealing with attacks on water and wastewater infrastructure. The Environmental Protection Agency says more than 100 drinking water and wastewater systems across 12 states have been targeted by high-profile cyberattacks this year.
A National Pattern
Federal authorities warned in July that malicious actors were targeting internet-connected operational technology at water and wastewater utilities nationwide. At that time, the FBI and EPA said utilities in at least seven states had reported incidents, some of which degraded water operations.
Officials said attackers had remotely accessed internet-facing programmable logic controllers, or PLCs, and tampered with device configurations, in some cases causing utilities to lose monitoring or control capabilities. Reported effects elsewhere have included loss of water pressure and flooding.
The Colorado breaches follow a wave of attacks on water systems this summer, including cyber activity affecting more than 30 community water systems in Minnesota. Federal investigators have examined whether Iranian actors or hackers affiliated with Iran were responsible for the Minnesota incidents, though officials had not publicly attributed that activity.
President Donald Trump disputed suggestions that Iran was behind the Minnesota attacks, saying during a Cabinet meeting, “They blame it on Iran. I don’t think so.” He instead blamed Minnesota officials.
Small Utilities, Limited Resources
The recent incidents have renewed attention to longstanding cybersecurity vulnerabilities in America’s water infrastructure, particularly among small and rural utilities that often have limited cybersecurity staff and resources.
Many utilities rely on internet-connected industrial control systems to remotely monitor and operate pumps, valves, water pressure and other equipment. Federal officials have urged operators to remove programmable logic controllers from direct internet exposure and to strengthen authentication and access controls.
The EPA, which serves as the federal government’s sector risk management agency for water and wastewater systems, told Fox News Digital it is working with utilities, states and federal partners to identify vulnerabilities and strengthen cybersecurity. Since fiscal year 2025, the agency has identified more than 900 vulnerabilities in over 650 water systems and helped eliminate about 700 of them at more than 500 utilities. The EPA has also conducted more than 710 cybersecurity risk assessments and provided direct technical assistance to approximately 15,900 utilities.
The FBI declined to comment.
You must be logged in to post a comment Login