It has been revealed that in late August 2026, foreign hackers infiltrated two small water treatment facilities in Colorado and actually altered the settings of their control equipment. It was confirmed that they disabled remote access and alarm functions and changed the pump operation cycles.
Both facilities were private operators supplying water to fewer than 200 people each. Although the incident was brief and there were no known impacts on treatment processes, water quality, water supply, or public safety, it is significant in that the digital intrusion led to the manipulation of real-world industrial control equipment.
| Beyond Simple Connection Logs
According to Ally Sullivan, a spokesperson for the Colorado Governor's Office, The attacker changed the equipment settings, disabled remote access and alarms, and altered the pump cycle. The very function that allows operators to check the status of equipment and take appropriate action has been affected.
Operational technology for water supply systems controls physical equipment such as pumps, valves, and treatment facilities. Therefore, unlike typical cyberattacks that merely steal information, changes to system settings could potentially affect water pressure or the water supply process.
| Damage to Water Quality and Public Safety
The state government explained that both incidents were resolved quickly and that the facility operators addressed the risks promptly and then notified the state government. To date, neither the treatment process nor water quality has been affected, and no water service interruptions or public safety hazards have been confirmed.
While the finding that there was no harm is important, it does not diminish the seriousness of the incident. The fact that the alerts and remote management features were turned off means that the operator might have detected the anomaly late; if this had occurred at a larger facility or involved a prolonged breach, the scope of the impact could have been different.
| Attacker
The Colorado Governor's Office stated that it could not confirm whether any foreign entities were involved. While it noted that there have been a series of attempts across the United States by groups suspected of receiving support from Iran to gain access to water systems, it did not conclude that these two incidents were the work of such groups.
You can't identify the attacker just because the methods were similar or the same type of equipment was used. An analysis by technical and intelligence agencies is needed, taking into account access logs, the infrastructure used, and the sequence of commands.
| Trends in Water System Attacks Across the United States
On July 30, 2026, the FBI and the U.S. Environmental Protection Agency issued a warning about attacks targeting industrial control systems exposed to the internet. At the time, water and wastewater utilities in at least seven states reported incidents, and some experienced operational disruptions.
Reuters reported, citing an August CISA advisory, that there were instances where approximately 12 states and 100 water utilities were affected by such attacks. Although it has not yet been confirmed whether the Colorado incident is part of the same operation, it is clear that control equipment at small-scale facilities is being repeatedly targeted.
| Security Gaps in Small Facilities
Small-scale water utilities often operate aging equipment with limited personnel and budgets. While they may connect control equipment to the Internet for remote maintenance, it can be difficult for them to implement strong authentication, network segmentation, and continuous log monitoring.
This incident is This shows that even if a facility is small, it is still a critical piece of infrastructure. This requires joint support from state and federal agencies, a budget for equipment replacement, training for operational staff, and an incident reporting system.
| Not only recovery capabilities, but also manual operation capabilities
In an industrial control environment, it must be possible to isolate compromised equipment and safely switch to manual operation. Keeping regular backups and equipment logs of your normal settings helps you quickly identify and recover from any changes.
The FBI and EPA also recommended disconnecting control equipment from the public internet, implementing strong authentication and access controls, and regularly testing manual operation and recovery procedures. It's important to take an approach that ensures the entire operation is prepared to withstand an outage, rather than relying on a single piece of security equipment.
| Hands-on Equipment Operation
As far as we know at this point, configuration changes occurred at two small facilities in late August, and the issue was quickly resolved. The names of the facilities and the specific equipment configurations have not been disclosed, and the perpetrator of the attack has not been identified.
Going forward, we need to investigate any connections to incidents in other areas, the point of entry, and whether there has been additional damage at facilities using the same equipment. This case is This is a warning that, when it comes to the security of critical infrastructure, we must monitor not only data breaches but also actual operational changes.
References
Tags
#Colorado #Water Supply Security #Cybersecurity #Industrial Control Systems #OT Security #Critical Infrastructure #Hacking #Water Safety #FBI #CISA #EPA #Security Incident #Privacy
