Foreign hackers breach operational systems at two small Colorado water utilities

On 18 September 2026, the office of Colorado Governor Jared Polis disclosed that foreign hackers had breached the operational technology of two small water utilities in the state during the previous month, in intrusions that reached the industrial control systems governing water treatment and distribution.

According to the governor's office, the attackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles at the affected systems, each of which serves fewer than 200 people. The disruptions were described as brief and were addressed by the operators themselves, who then alerted the state; officials said the incidents did not affect water quality, treatment processes or public safety.

Attribution left open

Colorado officials declined to attribute the intrusions to a specific country or group, saying only that "foreign actors" were responsible and that they could not confirm who was involved. The disclosure came amid repeated federal warnings — from the FBI and the Cybersecurity and Infrastructure Security Agency — about escalating attempts by state-linked adversaries, including Iran-nexus and China-nexus groups, to reach the control systems of U.S. drinking-water and wastewater providers.

A recurring target

Small utilities are considered especially exposed because they often run internet-facing control equipment with minimal network segmentation and limited security staffing. The Colorado breaches added to a growing tally of intrusions at U.S. water systems, underscoring the sector's status as a soft target for adversaries seeking footholds in critical infrastructure. With the affected systems restored and the intrusions contained, the incident's status was recorded as contained.