Colorado Water Utilities Hit by Cyberattacks Targeting OT Systems
Hackers described as foreign actors targeted OT/ICS at two small Colorado water utilities in late August, altering settings and alarms without disrupting service.
Attackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles at two private Colorado water utilities serving fewer than 200 people, with no impact on water services or public safety. Colorado's governor's office attributed the attacks only to 'foreign actors,' noting CISA is tracking Iranian-backed efforts against US drinking and wastewater systems. A broader campaign hit internet-exposed water systems in at least a dozen states, with CISA aware of 100 targeted systems in July. No utilities were named and attribution remains unconfirmed.
- Two Colorado water utilities serving under 200 people attacked via OT/ICS systems
- Attackers altered equipment settings, disabled alarms and remote access, and changed pumping cycles
- Governor's office cites possible Iranian-backed water sector campaign, but attribution is unconfirmed
- CISA reported 100 internet-exposed water systems targeted in July across at least a dozen states
Full article326 words · extracted from securityweek.com · click to collapse
Hackers targeted operational technology (OT) systems at two private water utilities in Colorado in late August, apparently attempting to cause disruptions.
Few technical details are available, but it seems the attackers targeted industrial control systems (ICS) at the water utilities, which serve fewer than 200 people.
A spokesperson for Colorado Governor Jared Polis told The Denver Post [paywalled] that the attackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles. However, the disruptions were brief and did not affect water services or public safety.
Hands-On Cyber-Physical Systems Training at ICS Cybersecurity Conference
The Colorado governor’s office has not named the affected utilities or said who is behind the attack, describing the attacker only as “foreign actors.”
“We cannot confirm what foreign actors may have been involved, but we are aware of ongoing efforts across the nation by an Iranian-backed group to access drinking water and wastewater systems, as per the Cybersecurity and Infrastructure Security Agency,” the spokesperson said.
Advertisement. Scroll to continue reading.
Despite the mention of the Iran-linked attacks, it has not been confirmed that the Colorado utilities were targeted as part of the campaign that hit the water sector in at least a dozen states across the United States in July.
While federal authorities have not released a complete list of affected utilities, confirmed targets span facilities in Minnesota, Michigan, Georgia, South Dakota, New Jersey, Wisconsin, and Alabama.
CISA urged the water sector to secure OT in light of these attacks. The cybersecurity agency said it is aware of 100 internet-exposed water systems targeted in cyberattacks in July.
Independent security group Infracritical has established a central repository aggregating technical indicators and operational data from the recent water sector breaches.
Related: US Water Systems Get Cyber Boost From New Senate Bill and ‘Water Watch Center’
Related: Cyberattacks on Two Oil Tankers Prompt Coast Guard, FBI to Board Vessels
Related: Ransomware Attacks on Manufacturers Surge as Supply Chain Risk Grows