Foreign Hackers Breach Colorado Water Utilities, State Officials Say
Cyber intrusions altered pumping cycles and disabled alarms at two facilities, though drinking water quality remained unaffected.
Foreign actors breached the computer systems of two Colorado water utilities last month, manipulating equipment and disabling safety features before operators regained control, according to state officials.
The intrusions, which occurred in September, altered pumping cycles, disabled alarms, and changed equipment settings at the two facilities. While these actions did not affect the quality or treatment of drinking water, they highlight a growing national security concern regarding the vulnerability of U.S. water infrastructure.
Colorado Governor Jared Polis' office confirmed the incidents, stating that the providers quickly addressed the risks and subsequently alerted the state. Officials have not identified the actors behind the breaches nor have they definitively linked them to a wider series of cyberattacks targeting water systems across the country.
These incidents add Colorado to a growing list of states experiencing similar breaches. According to the Environmental Protection Agency (EPA), more than 100 drinking water and wastewater systems across 12 states have been targeted this year. Federal authorities issued warnings in July that malicious cyber actors were targeting internet-connected operational technology at water and wastewater utilities, with incidents reported in at least seven states that degraded water operations.
The affected systems in Colorado provide drinking water to approximately 400 people. The breaches underscore how hackers can access operational technology that controls physical equipment like pumps and valves, extending beyond traditional computer networks.
Investigations into similar cyber activity affecting water systems in Minnesota earlier this year have examined whether Iranian actors or hackers affiliated with Iran were responsible, though no public attribution was made at the time. Former President Donald Trump had previously disputed suggestions of Iranian involvement in the Minnesota attacks.
Federal agencies, including the FBI and EPA, have been alerting utilities about these threats. The EPA, which acts as the federal sector risk management agency for water and wastewater systems, has been working with utilities and state partners to identify vulnerabilities and enhance cybersecurity. Since fiscal year 2025, the agency has identified over 900 vulnerabilities at more than 650 water systems and assisted in resolving approximately 700 of them at over 500 utilities. The EPA has also conducted over 710 cybersecurity risk assessments and provided direct technical assistance to about 15,900 utilities.
Many water utilities, particularly smaller and rural ones, face challenges with limited cybersecurity staff and resources. Federal officials continue to urge operators to isolate critical control systems from the public internet and strengthen access controls to mitigate these risks.