Colorado Governor Jared Polis’s office said in a statement carried by KRDO (18 September 2026, 5:23 pm US Mountain time; 19 September, 7:23 am Perth) that foreign actors were involved in cybersecurity incidents at two small, private water providers serving fewer than 200 people. The incidents involved individuals changing equipment settings, disabling remote access and alarms, and altering pumping cycles.

The governor’s office says the incidents were brief, the providers quickly addressed the risks and notified the state in late August, CDPHE followed up with each provider, and to its knowledge treatment processes and water quality were not affected and there was no impact to public safety; the providers were not named.

It says it cannot confirm which foreign actors were involved but is aware, per CISA, of ongoing efforts by an Iranian-backed group to access US drinking water and wastewater systems.

Broader context: FBI/EPA Public Service Announcement I-073026-PSA (30 July 2026) warns that malicious actors have been targeting internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 PLCs in the water and wastewater sector across multiple US states since late July 2026, changing device IPs and passwords and degrading monitoring and control. Australia relevance: the same internet-facing PLC / weak remote-access pattern applies to AU water and wastewater operators — remove PLCs from direct internet exposure, enforce unique passwords and ACLs, and keep manual-operation readiness per FBI/EPA guidance.

Correction (26 Oct 2026): removed the SecurityWeek credit and link; the incident details are credited to the governor’s office statement as carried by KRDO, and the card no longer says the systems were accessed in late August — the providers notified the state then.

The card date has moved from 18 to 19 September 2026, the Perth date of KRDO's report (18 September, 23:23 UTC; 19 September, 7:23 am Perth time (AWST)). (source: KRDO)