Foreign hackers breached two small Colorado water utilities, officials still can't identify attacker
Unknown hackers broke into two small Colorado water utilities in late August, changing pump settings, disabling alarms, and cutting remote access. State officials call the intruders foreign actors but have not identified a country or group. No harm reached drinking water quality.
Two small Colorado water utilities, each serving fewer than 200 residents, were breached by unknown hackers in late August 2026. According to Governor Jared Polis's office, the intruders changed equipment settings, disabled remote access and alarms, and altered pumping cycles before the providers caught and stopped the activity themselves. State officials call the intruders foreign actors but have not identified a specific country or group, and it remains unclear whether the intrusion is connected to earlier hacking attempts against Colorado utilities in July. The FBI's Denver field office and the federal Cybersecurity and Infrastructure Security Agency are now involved. No harm reached drinking water quality or treatment processes at either utility. Separately, federal investigators have logged over 100 cyberattacks on water systems across 12 states in 2026, including more than 30 in Minnesota, where officials examined a possible Iranian connection that President Trump has disputed. The incidents highlight a persistent vulnerability: many of America's smallest water systems run decades-old industrial control equipment with limited cybersecurity budgets, making them easier targets than city-scale utilities.