Colorado Water Utilities Hit by Cyberattacks Targeting OT Systems

Cyberattacks on Colorado Water Utilities

In late August, two private water utilities in Colorado were subjected to cyberattacks targeting their operational technology (OT) systems. These utilities serve fewer than 200 people. The attacks involved changes to equipment settings, disabling of remote access and alarms, and alterations to pumping cycles.

Limited Impact and Unidentified Attackers

Despite the attempts to disrupt operations, the incidents were brief and did not affect water services or public safety. The Colorado governor’s office has not identified the affected utilities or the perpetrators, only describing them as “foreign actors.” While an Iranian-backed group has been mentioned in connection with ongoing efforts to access water systems nationwide, it has not been confirmed that these specific Colorado incidents are part of that campaign.

Broader Context of Water Sector Attacks

These attacks in Colorado are part of a larger trend, as the water sector has seen similar incidents in at least a dozen states across the United States in July. Confirmed targets include facilities in Minnesota, Michigan, Georgia, South Dakota, New Jersey, Wisconsin, and Alabama. The Cybersecurity and Infrastructure Security Agency (CISA) has noted awareness of 100 internet-exposed water systems targeted in cyberattacks during July.

Call for Enhanced Security

In response to these incidents, CISA has urged the water sector to enhance the security of their OT systems. The independent security group Infracritical has also established a central repository to aggregate technical indicators and operational data from the recent water sector breaches, aiming to aid in understanding and mitigating future threats.