Foreign actors alter settings at two small Colorado water utilities
August, 2026 (Late August 2026, disclosed September 17)
Colorado officials said that in late August, foreign actors changed equipment settings, disabled remote access and alarms, and altered pumping cycles at two small private water providers, each serving fewer than 200 people. Operators regained control, and officials said treatment and water quality were not affected. The utilities and the attackers have not been named. Officials said they know of Iranian activity against water systems but there is no confirmation that these incidents belong to the same campaign. The EPA says more than 100 water and wastewater systems in 12 states have been targeted this year.
Why it matters
Disabling alarms and remote access is what an attacker does to blind operators. Small operators often have no security staff.
What defenders can take from it
- Keep an independent way to see abnormal pump or pressure behavior that does not rely on the same remote access.
- The EPA reports helping fix about 700 vulnerabilities at more than 500 utilities since fiscal 2025. Small operators can ask it for help.