Foreign actors breach Colorado water systems
Add Axios as your preferred source to
see more of our stories on Google.
Illustration: Brendan Lynch/Axios
Foreign actors last month breached two small Colorado water utilities and manipulated equipment used to control drinking water systems.
Why it matters: The attacks come amid heightened concern about foreign actors infiltrating U.S. water systems — including recent attacks linked to actors suspected of ties to Iran.
Driving the news: The two privately owned utilities, each serving fewer than 200 people, were breached in late August, Gov. Jared Polis' office told Axios.
- The hackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles, spokesperson Ally Sullivan said.
- The disruptions were brief and caused no known impacts to water treatment, water quality or public safety, Sullivan said.
- State officials have not identified the utilities or determined who was behind the breaches.
What they're saying: "We cannot confirm what foreign actors may have been involved," Sullivan told Axios.
- She noted federal officials are tracking efforts by an Iranian-backed group to access drinking water and wastewater systems nationwide.
The big picture: Colorado joins a growing list of at least a dozen states confronting cyberattacks on the technology controlling water systems.
- In July, the FBI said at least seven states had reported attacks on internet-connected controllers, with some incidents causing lost water pressure and flooding.
- A separate federal advisory in August warned of an "active cyber threat" involving another family of industrial controllers used across critical infrastructure, including water and wastewater systems.
Zoom in: Denver Water, which serves about 1.5 million people across the metro area, tells Axios it evaluated the threat and determined its systems aren't affected.
- Spokesperson Todd Hartman said the utility works with state and federal cybersecurity officials to assess potential threats.
Meanwhile, state health officials confirmed the problems were resolved, offered the affected utilities technical assistance and alerted other Colorado water providers.
- The state is urging providers to review their security and make necessary updates.
What we're watching: The FBI declined to comment on the Colorado incidents. Axios has asked federal officials whether the breaches match attacks elsewhere and whether other Colorado utilities have been targeted.