Foreign actors breach two Colorado water utilities, alter pumping cycles and disable alarms

In late August 2026, foreign actors gained unauthorized access to the operational technology systems of two private water utilities in Colorado, each serving small communities with a combined population of approximately 400 residents. The intruders altered equipment settings, changed pumping cycles, disabled alarms, and cut off remote access before operators detected the intrusions and restored manual control. Colorado Governor Jared Polis' office disclosed the incidents on September 18, 2026, issuing a statewide security alert to all Colorado water and wastewater providers. Drinking water quality and treatment processes were not compromised. Federal investigators were examining whether the attacks were connected to the broader suspected Iranian-affiliated campaign that had targeted more than 30 Minnesota water utilities on July 26-27 and, according to the EPA, had reached more than 100 water and wastewater systems across 12 states during 2026. The names of the two affected utilities were not disclosed.

Operational disruption at two small Colorado water utilities serving approximately 400 residents; pumping cycles altered, alarms disabled, equipment settings changed, and remote access cut off before operators regained manual control. No public health impact; drinking water quality and treatment were not compromised. Statewide security guidance issued to all Colorado water and wastewater providers. Financial losses not disclosed.