Foreign Hackers Breach Two Colorado Water Utilities, Officials Say

Two small Colorado water utilities were breached by foreign actors last month, with hackers changing pumping schedules, altering equipment settings and disabling alarms before operators regained control, state officials said.

The affected systems are privately owned and each serves fewer than 200 people, according to Fox News, which cited reports from Colorado officials.

The governor's office said the attacks did not affect drinking water quality or treatment processes.

Colorado officials have not identified who was behind the intrusions or confirmed whether the incidents were connected to cyberattacks reported against water systems in other states.

"These two incidents consisted of individuals changing equipment settings, disabling remote access and alarms, and altering pumping cycles," a spokesperson for Gov. Jared Polis said. The incidents were brief, and the utilities notified state officials after addressing the problems.

The attacks are significant because they involved operational technology, which connects computer systems to physical equipment such as pumps and valves.

Access to those systems can allow an attacker to interfere with how a utility operates even without affecting the quality of the water itself.

The two Colorado systems serve approximately 400 people combined. State officials did not publicly identify the utilities involved.

The incidents come as federal agencies continue warning water providers about cyber threats involving internet-connected industrial equipment.

The EPA said in April that Iranian-affiliated actors had been exploiting internet-connected programmable logic controllers at water and wastewater systems and causing disruptions in some cases.

The EPA said in August that high-profile cyberattacks during 2025 had targeted more than 100 drinking water and wastewater systems across 12 states.

The agency has also said it identified cybersecurity vulnerabilities at 277 water systems in 2025 and worked with utilities to address them.

Federal officials have urged water providers to limit internet exposure for operational technology and strengthen authentication and access controls.

The EPA has offered cybersecurity assessments, technical assistance and other resources to help utilities identify and address vulnerabilities.

The Colorado incidents have not been publicly attributed to Iran or any other specific foreign government or group. Officials also have not said whether the attacks caused any lasting operational problems at either utility.

Watch the video below: