Late in August, someone reached into the operational technology of two private water utilities in Colorado. Tampering touched equipment settings, cut remote access, silenced alarms and shifted pumping cycles.
Fewer than 200 people are served by either utility. Governor Jared Polis’s office, in comments to The Denver Post, described the outages as short-lived and said neither water delivery nor public safety was harmed. The utilities went unnamed, and the attacker was identified only as “foreign actors.”
Warnings from CISA about an Iranian-backed push against drinking water and wastewater systems were cited by a spokesperson. Whether that campaign is the one behind the Colorado incident is unconfirmed.
Water providers in at least a dozen states were hit in July. No complete federal roster of those victims exists, but confirmed sites run from Alabama and Wisconsin through New Jersey, South Dakota, Georgia and Michigan to Minnesota. CISA itself counted 100 internet-exposed water systems among the July targets and told the sector to lock down its OT.
Small plants, exposed controls
A dedicated OT security team is a budget line most small utilities cannot carry, yet their controls answer to the internet and households absorb the consequences.
Operators who cannot afford a security team now have one place to look: Infracritical, an independent group, has gathered technical indicators and operational data from the water sector’s recent breaches into a single repository open to all.
Practical steps for defenders: take internet-facing OT off the public internet, demand multi-factor authentication for every remote path, and treat a silenced alarm as a detection event rather than a nuisance. Alarm suppression ahead of a setpoint change is a script opponents follow, and that silence is itself the signal.
