Colorado Water Utilities Targeted in OT Cyberattack

In late August, attackers targeted the operational technology (OT) infrastructure of two private water utilities in Colorado. The intrusion involved changing equipment parameters, disabling remote‑access capabilities, turning off alarm systems, and modifying pumping schedules.

Impact

The utilities, each serving fewer than 200 residents, experienced brief operational disruptions but no interruption to water service or public safety. The incident was contained quickly, with no evidence of data exfiltration or long‑term damage.

Who is affected

Both utilities and the communities they serve are directly impacted. The attack demonstrates the vulnerability of small‑scale water treatment plants to industrial‑control‑system (ICS) compromise.

What defenders should do

• Verify that all OT devices have the latest firmware and security patches.
• Re‑enable and harden remote‑access controls; enforce multi‑factor authentication.
• Confirm that alarm and monitoring systems are operational and alerting to anomalous changes.
• Implement continuous configuration monitoring to detect unauthorized parameter changes.
• Coordinate with state and federal agencies for threat intelligence updates.

Threat context

Officials have not identified the perpetrators, only describing them as “foreign actors.” The incident aligns with a broader pattern of Iranian‑backed groups probing drinking‑water and wastewater systems across the United States.