Colorado governor says 'foreign actors' targeted small, private water providers

Colorado officials say two small, privately operated water providers were targeted by “foreign actors” in brief incidents that did not compromise treatment or water quality.

The affected systems each serve fewer than 200 people, according to the office of Gov. Jared Polis. A spokesperson said the incidents involved changing equipment settings, disabling remote access and alarms, and altering pumping cycles.

“These two incidents consisted of individuals changing equipment settings, disabling remote access and alarms, and altering pumping cycles,” the spokesperson said. “These were brief incidents and the risks were quickly addressed by the providers themselves, who subsequently alerted the state. To our knowledge, treatment processes and water quality were not impacted at either provider.”

Federal warning follows summer attacks

The governor’s office did not identify the foreign actors, but said it was aware of Iranian activity targeting water systems around the country.

The disclosure comes as federal officials warn local water systems about an increase in cyberattacks. Over the summer, Iran was the prime suspect in cyberattacks that hit water treatment and wastewater utilities, according to sources. Those attacks can blind utility operators by changing passwords or disabling alarms, the sources said, though Iran’s involvement has not been officially confirmed.

At least a dozen states have reported possible cyber intrusions targeting water and wastewater utilities, multiple sources told ABC News.

The FBI is urging utilities to disconnect systems from the internet where possible, use systems with breakers, and become familiar with reverting to manual controls if automated systems are compromised.

For small providers, the incidents underscore a broader vulnerability: even systems serving only a few hundred customers can be drawn into a widening campaign against U.S. water infrastructure. That makes basic cyber hygiene—such as segmenting networks, limiting remote access and rehearsing manual operations—increasingly important when outsiders can disable alarms and remote access that operators rely on to monitor systems.

Adobe Stock photos: Colorado state flag and the dome of the Colorado Capitol Building with the state flag.