- Two privately owned Colorado water utilities, each serving fewer than 200 people, were breached in late August by foreign actors who manipulated equipment used to control drinking water systems.
- Hackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles. The disruptions were brief and caused no known impacts to water treatment, water quality or public safety.
- State officials have not identified the utilities or determined who was behind the breaches. Federal officials are tracking efforts by an Iranian-backed group to access drinking water and wastewater systems nationwide.
- Colorado joins a growing list of at least a dozen states confronting cyberattacks on the technology controlling water systems. In July, the FBI said at least seven states had reported attacks on internet-connected controllers, with some incidents causing lost water pressure and flooding.
- A separate federal advisory in August warned of an active cyber threat involving another family of industrial controllers used across critical infrastructure, including water and wastewater systems.
- Denver Water, which serves about 1.5 million people across the metro area, evaluated the threat and determined its systems are not affected.
Quotes
“We cannot confirm what foreign actors may have been involved”
“The two privately owned utilities, each serving fewer than 200 people, were breached in late August, Gov. Jared Polis' office told Axios.”
“Denver Water, which serves about 1.5 million people across the metro area, tells Axios it evaluated the threat and determined its systems aren't affected.”