Foreign Actors Targeted Colorado Water Providers, Governor Confirms

Two small, private water utilities in Colorado were the targets of cyber intrusions by foreign actors last summer, according to a statement from Governor Jared Polis’s office. The incidents involved individuals manipulating equipment settings, turning off remote access and alarms, and modifying pumping cycles.

A spokesperson for the governor confirmed that the disruptions were short-lived and that the providers themselves quickly neutralized the risks before alerting state authorities. Importantly, officials stated that there is no evidence that water treatment processes or water quality were affected at either facility.

The compromised systems served fewer than 200 people each. While the governor’s office did not explicitly identify the perpetrators, it acknowledged awareness of Iranian activity targeting water infrastructure nationwide. Over the summer, Iran was considered the primary suspect in a wave of cyberattacks against water and wastewater utilities across the country. These attacks typically involve changing passwords or disabling alarms to blind operators, though official confirmation of Iranian involvement has not yet been issued.

This event is part of a broader trend, with at least a dozen states reporting potential cyber intrusions against water and wastewater utilities, according to multiple sources speaking with ABC News. In response to the rising threat, the FBI is urging utility operators to disconnect systems from the internet whenever possible, utilize systems with manual breakers, and become proficient in reverting to manual controls if automated systems are compromised.