Foreign Actors Breach Two Colorado Water Utilities, Tamper With OT Systems

Unidentified foreign actors gained unauthorized access to the operational technology environments of two small, privately owned water utilities in Colorado, according to reports dated September 18, 2026. The attackers altered equipment settings, disabled remote access and alarms, and changed pumping cycles at the affected facilities. Disruptions were short-lived, and authorities confirmed no known impact on water treatment, water quality, or public safety. The method used to gain initial access — whether through exposed controllers, stolen credentials, or remote-access infrastructure — has not been publicly disclosed. Officials said the issues were resolved, though the specific actions taken at each individual utility have not been detailed.