Colorado: foreign actors breached OT at two small water utilities (late Aug); alarms disabled, pumping cycles altered
Colorado Governor Jared Polis’s office (statement carried 18 September 2026 by KRDO and other outlets; SecurityWeek 21 September) disclosed that foreign actors accessed computer systems at two privately owned Colorado water utilities, each serving fewer than 200 people, in late August 2026. Intruders changed equipment settings, disabled remote access and alarms, and altered pumping cycles. The state says the incidents were brief, providers remediated quickly and notified the state, CDPHE followed up, and there was no known impact to treatment, water quality, or public safety; the utilities were not named. Attribution is unconfirmed; the governor’s office cites CISA awareness of Iranian-backed targeting of US drinking water and wastewater systems. Broader context: FBI/EPA Public Service Announcement I-073026-PSA (30 July 2026) warns that malicious actors have been targeting internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 PLCs in the water and wastewater sector across multiple US states since late July 2026, changing device IPs and passwords and degrading monitoring and control. Australia relevance: the same internet-facing PLC / weak remote-access pattern applies to AU water and wastewater operators — remove PLCs from direct internet exposure, enforce unique passwords and ACLs, and keep manual-operation readiness per FBI/EPA guidance.
- Product
- Water/wastewater OT (Colorado disclosure); FBI/EPA note Rockwell Automation/Allen-Bradley MicroLogix 1100/1400 among targeted PLCs nationally
- Exploited in Australia?
- unknown
- Patch to
- Water/wastewater operators: remove PLCs from direct internet exposure (secure gateway/firewall); strong unique passwords; ACLs; enable logging; place key switches in run; prepare manual operations; review FBI/EPA PSA I-073026-PSA and CISA OT secure-connectivity guidance
Primary: KRDO — Colorado governor’s office statement (18 Sep 2026) · Vendor: FBI/EPA PSA I-073026-PSA — WWS MicroLogix OT targeting (30 Jul 2026) · SecurityWeek — Colorado water utilities OT attacks (21 Sep 2026)