Foreign Hackers Breach Colorado Water Utilities' OT Systems
Attackers altered equipment settings but caused no service disruptions.
1Targeted OT systems
Foreign hackers compromised operational technology systems at two small Colorado water utilities in late August. Attackers modified equipment settings, disabled remote access and alarms, and altered pumping cycles. The intrusions were brief and didn't affect water quality or service delivery. Both utilities serve fewer than 200 customers, though their names remain undisclosed. Colorado's governor confirmed the attacks involved foreign actors but provided no specific attribution.
2Attack methodology
The attackers exploited internet-exposed programmable logic controllers (PLCs), small industrial computers controlling pumps and valves. Many compromised systems connected directly to cellular modems without firewalls. Hackers changed device IPs and passwords, sometimes disabling shutdown processes. This matches patterns seen in July attacks on water facilities across multiple states. CISA warns direct PLC internet connections create significant security risks that utilities must address.
3Broader campaign concerns
While unconfirmed, officials suspect Iranian-backed groups behind recent water system attacks nationwide. Similar incidents occurred in at least a dozen states in July. The Colorado attacks renew concerns about small utilities' cybersecurity weaknesses, often lacking dedicated security staff. CISA issued guidance on securing exposed PLCs after July's widespread breaches affected over 100 water sector systems. The agency emphasizes balancing necessary remote access with proper security measures.
4Limited immediate impact
Despite changing critical settings, the Colorado intrusions caused no service disruptions or safety issues. Operators quickly addressed risks and alerted state authorities. The incidents highlight how attackers can access systems without causing immediate damage, potentially laying groundwork for future disruptions. This aligns with patterns where hackers first gain access to study systems before executing more damaging attacks during crises.
5Response and mitigation
CISA published detailed guidance on August 21 for utilities to identify and secure internet-exposed systems. The agency recommends removing unnecessary remote access while properly securing essential connections. Since FY2025, EPA has identified 900+ vulnerabilities across 650+ water systems and helped address 700 at 500+ utilities. They've conducted 710+ cybersecurity assessments and supported nearly 15,900 utilities with technical assistance.
6Sector-wide vulnerabilities
Water infrastructure's distributed nature makes small utilities attractive targets. Many lack resources for robust cybersecurity despite controlling critical public health systems. Recent attacks demonstrate how simple configuration errors—like exposed PLCs—can enable breaches. The sector faces challenges balancing operational technology needs with security, particularly for remote monitoring and control systems essential for geographically dispersed facilities.
7Attribution challenges
Officials haven't formally attributed the Colorado attacks but note Iranian-linked groups targeting water systems nationally. The incidents share tactics with July's multi-state campaign, though direct connections remain unconfirmed. Attribution difficulties complicate responses, as defenders must prepare for various threat actors. The pattern suggests testing capabilities rather than immediate destructive intent, possibly gathering intelligence for future operations.
8Strategic implications
These incidents underscore water infrastructure's critical vulnerability to cyber threats. While causing no harm this time, they demonstrate attackers' ability to manipulate industrial control systems. The attacks test response protocols and potentially establish footholds for future disruptions. They highlight the need for sector-wide security improvements, particularly for smaller utilities that may lack dedicated cybersecurity personnel but control essential services.
Original article: Security Affairs — Foreign Hackers Breach Colorado Water Utilities' OT Systems