Foreign Hackers Breach Two Colorado Water Utilities

Foreign actors breached two small, privately owned Colorado water utilities in late August, changing equipment settings, disabling remote access and alarms, and altering pumping cycles before operators regained control. The utilities, each serving fewer than 200 people, reported no known effect on water treatment, drinking-water quality, public safety, or service, and the incidents were quickly resolved. State officials have not identified the attackers or determined whether the breaches were connected to a broader campaign, but they said federal agencies are tracking efforts by an Iranian-backed group to access U.S. water and wastewater systems. The incidents add Colorado to a growing number of states reporting cyber intrusions targeting internet-connected operational technology at water facilities. Federal and state officials are urging utilities to strengthen cybersecurity, limit internet exposure where possible, and prepare to operate equipment manually if automated systems are compromised.