Cyberattacks hit industrial controls at two small Colorado water utilities
Two small, privately run water utilities in Colorado, each serving fewer than 200 people, had their industrial control systems tampered with in a cyberattack, Colorado Governor Jared Polis's office confirmed on 21 September1. Attackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles, though the disruption was brief and did not affect water service or public safety, a spokesperson for the governor said1. The state described the attackers only as foreign actors and has not attributed the intrusion to a specific group1. The governor's office, through spokesperson Ally Sullivan, said it "cannot confirm what foreign actors may have been involved, but we are aware of ongoing efforts" across the sector to target water utilities2.
The spokesperson pointed to CISA guidance on an ongoing, Iran linked effort to access drinking water and wastewater systems nationally, but the state has not confirmed a link between that campaign and the Colorado incident1. CISA has said it is separately aware of roughly 100 internet exposed water systems targeted in July, with confirmed victims in Minnesota, Michigan, Georgia, South Dakota, New Jersey, Wisconsin and Alabama1.
Why it matters: Small water utilities often run internet exposed industrial control systems with thin security staffing, and this incident lands inside a pattern CISA has already flagged nationally.