Foreign Hackers Target Two Colorado Water Utilities
Foreign hackers briefly altered OT settings at two small Colorado water utilities without disrupting service.
Foreign attackers accessed operational technology at two small private Colorado water utilities in late August 2026, changing equipment settings, disabling remote access and alarms, and altering pumping cycles. Governor Jared Polis's office said the brief intrusions did not affect drinking water quality, treatment, or public safety; the utilities serve fewer than 200 people and were not named. Officials cited an Iranian-backed effort against U.S. water systems but said they could not confirm which actors were involved or a link to July incidents that hit exposed PLCs in at least a dozen states. In those earlier cases, attackers changed PLC addresses and passwords and sometimes disabled shutdown processes.
- Two private Colorado utilities serving under 200 people were hit in late August.
- Attackers changed OT settings, disabled alarms and remote access, and altered pumping cycles.
- Drinking water quality, treatment, and service were not affected.
- Officials did not confirm a link to July's suspected Iranian-linked PLC incidents.
- CISA warned that cellular-connected PLCs were exposed without firewalls.
- ATT&CK
- T1133 External Remote ServicesT1565 Data ManipulationT1489 Service StopT1098 Account Manipulation
- Products
- PLC
- Victims
- Colorado water utilities
- Countries
- United StatesIran
From the original article
3 min read at securityaffairs.com
Hackers targeted two Colorado water utilities, changing OT settings and disabling alarms, but causing no impact on water services or safety. Foreign hackers targeted the operational technology (OT) systems of two small private water utilities in Colorado in late August, apparently trying to disrupt operations. Local authorities haven’t identified the affected utilities or the attackers.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.