Colorado water utilities: OT tampering weeks after the July wave

Foreign actors targeted the operational technology (OT) of two small private Colorado water utilities, serving fewer than 200 people, in late August, a spokesperson for Gov. Jared Polis told The Denver Post, as SecurityWeek reported on September 21. The attackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles, ABC News reported. The disruptions were brief and did not affect water services or public safety, SecurityWeek reported; the governor's office has not named the utilities or the attacker, describing it only as “foreign actors.”

A July wave hit the water sector in at least a dozen states, per SecurityWeek; CISA said it was aware of 100 internet-exposed water systems targeted that month. The governor's office cited CISA's warning about an Iranian-backed group targeting drinking-water and wastewater systems, but said it cannot confirm which foreign actors were involved. SecurityWeek noted that it has not been confirmed that the Colorado utilities were targeted as part of the July campaign.

The actions the governor's office described went straight at operations: changed settings and pumping cycles, disabled remote access and alarms. The disabled alarms matter most: they remove the operator's early warning. Your monitoring covers your network, not the controllers at the utility feeding your campus, plant or data center, and that utility may have no security staff. The seam sits between your continuity plan and someone else's OT.

• Map the water and wastewater utilities each site depends on, including small private operators.
• Ask those utilities how they control remote access and whether their controllers are internet-reachable.
• Exercise continuity for losing water or wastewater service.

For critical-infrastructure operators and the enterprises that depend on them, STRATUM — Cyber Threat is designed to profile the actors behind water-sector campaigns, with stated attribution confidence, and to warn of reconnaissance against an organization's own remote-access footprint, ranked by mission impact. It is not a SIEM replacement or vulnerability scanner, and it does not monitor control systems. Analysts decide which signals warrant a call to a utility or a change to a site's continuity posture.

Project Watershed 250, launched August 31, pairs water utilities with government and industry cybersecurity assistance to identify vulnerabilities and help utilities address them; on September 10, at the Billington Cybersecurity Summit, National Cyber Director Sean Cairncross said the White House plans to take the model to other critical infrastructure sectors, Nextgov/FCW reported. Colorado has not been tied to the July campaign, but water OT was still being targeted weeks later, down to utilities serving fewer than 200 people.