Photo: Vithun Khamsong / Moment / Getty Images
Foreign hackers recently breached the computer systems of two small water utilities in Colorado, according to state officials. The attacks, which occurred in late August, led to changes in pumping cycles, disabled alarms, and altered equipment settings before operators regained control. The affected utilities, both private and serving fewer than 200 people, promptly addressed the incidents and notified the state. Officials said no changes to water treatment or quality were detected, and service was not disrupted, according to The Denver Post.
The breaches come amid a nationwide increase in cyberattacks targeting water and wastewater infrastructure. The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) warned Thursday that such attacks have escalated, affecting at least seven states in recent weeks. Hackers have reportedly locked operators out of their operational technology networks, modified passwords, and changed device IP addresses. In some cases, this has forced water utilities to issue boil-water notices and revert to manual operations.
Colorado Governor Jared Polis’ office stated that, while the specific origin of the hackers remains unclear, the state is aware of ongoing efforts by Iranian-backed groups to access U.S. drinking water and wastewater systems. State officials are now urging all Colorado water providers to review their cybersecurity practices and implement needed updates. The state is also distributing new guidance to agencies, including enhanced identity verification for job applicants to protect against international threats.