Colorado Water Utilities Hit by Cyberattacks Targeting OT Systems

Summary

Two private water utilities in Colorado were targeted by hackers in late August, with attackers altering equipment settings, disabling remote access and alarms, and changing pumping cycles. While the disruptions were brief and did not impact water services or public safety, the incident highlights ongoing concerns about foreign actors targeting critical infrastructure. The Colorado governor's office described the attackers as 'foreign actors' and noted awareness of Iranian-backed groups attempting to access drinking water systems nationwide.

Full text

Hackers targeted operational technology (OT) systems at two private water utilities in Colorado in late August, apparently attempting to cause disruptions. Few technical details are available, but it seems the attackers targeted industrial control systems (ICS) at the water utilities, which serve fewer than 200 people. A spokesperson for Colorado Governor Jared Polis told The Denver Post [paywalled] that the attackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles. However, the disruptions were brief and did not affect water services or public safety. Hands-On Cyber-Physical Systems Training at ICS Cybersecurity Conference The Colorado governor’s office has not named the affected utilities or said who is behind the attack, describing the attacker only as “foreign actors.” “We cannot confirm what foreign actors may have been involved, but we are aware of ongoing efforts across the nation by an Iranian-backed group to access drinking water and wastewater systems, as per the Cybersecurity and Infrastructure Security Agency,” the spokesperson said.Advertisement. Scroll to continue reading. Despite the mention of the Iran-linked attacks, it has not been confirmed that the Colorado utilities were targeted as part of the campaign that hit the water sector in at least a dozen states across the United States in July. While federal authorities have not released a complete list of affected utilities, confirmed targets span facilities in Minnesota, Michigan, Georgia, South Dakota, New Jersey, Wisconsin, and Alabama. CISA urged the water sector to secure OT in light of these attacks. The cybersecurity agency said it is aware of 100 internet-exposed water systems targeted in cyberattacks in July. Independent security group Infracritical has established a central repository aggregating technical indicators and operational data from the recent water sector breaches. Related: US Water Systems Get Cyber Boost From New Senate Bill and ‘Water Watch Center’ Related: Cyberattacks on Two Oil Tankers Prompt Coast Guard, FBI to Board Vessels Related: Ransomware Attacks on Manufacturers Surge as Supply Chain Risk Grows Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs Microsoft Patches 18 Vulnerabilities in AI, Cloud ProductsCheck Point, Kaspersky, Tanium Patch Product VulnerabilitiesCyberattacks on Two Oil Tankers Prompt Coast Guard, FBI to Board VesselsOpenAI Says Its Models Searched GitHub for Leaked API Keys During TrainingCISA Retires Weekly Vulnerability Bulletin in Risk-Based PivotAI Agents Can Retrain Own Models Mid-Task, Leaking Secrets and Erasing RefusalsPixel Modem Zero-Day Exploited in Targeted AttacksUS, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware Latest News Rust Team Members and Popular Crate Owners Targeted via Video CallsCrowdSec Confirms Source Code Stolen in Supply Chain AttackOrganizations Warned of 3 Exploited Linux Kernel VulnerabilitiesGoogle Confirms Gemini AI Breached Three FirmsTigerByte Cyber Emerges From Stealth With $3 Million in FundingIn Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP FlawAI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code23 Million User Records Compromised in Gyazo Data Breach Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Virtual Event: Attack Surface Management Summit 2026 September 16, 2026 Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs. Register Webinar: Building Continuous Authorization at Scale September 23, 2026 Explore what it takes to operationalize continuous authorization at scale, including the technical, organizational, and cultural changes required. Register People on the MoveVeritas Capital has appointed Joel Fulton as Chief Information Security Officer.incident.io has appointed Carlos Gonzalez-Cadenas as Chief Operating Officer.Ruben D. Chacon has joined ADM as Vice President and Global CISO.More People On The MoveExpert Insights “We Think the Security Control Is Working” Is No Longer Good Enough Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar) This Key Will Self-Destruct: An Open Standard for Revocable API Keys Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. (Matt Honea) What the Hugging Face Incident Teaches Security Leaders About AI Agent Access Security teams must treat autonomous agents as highly privileged identities. (Etay Maor) The Future of AI-Driven Security Depends on Complete Data For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality. (Danelle Au) The MFA Identity Trap: When Authentication Creates a False Sense of Security Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop. (Torsten George) Flipboard Reddit Whatsapp Whatsapp Email

Entities