Cyberattacks targeted industrial control systems (ICS) at two private water utilities in Colorado, affecting OT systems by changing equipment settings, disabling remote access and alarms, and altering pumping cycles. These actions caused brief disruptions but did not impact water services or public safety. The attackers are identified only as foreign actors, with possible ties to an Iranian-backed group involved in similar attacks on water systems in at least a dozen U.S. states. The incident aligns with a wider campaign against internet-exposed water systems, as noted by the Cybersecurity and Infrastructure Security Agency (CISA). No detailed technical indicators or exploit methods have been disclosed.

The attacks caused temporary disruptions to operational technology controlling water utility equipment, including changes to equipment settings and disabling of alarms and remote access. Despite these actions, water services and public safety were not affected. The incident highlights the risk to critical infrastructure OT systems from cyber threats but did not result in lasting operational impact or service outages in this case.

No official vendor advisory or patch information is available for this incident. The Cybersecurity and Infrastructure Security Agency (CISA) has urged the water sector to secure operational technology systems to prevent similar attacks. Organizations in the water sector should follow CISA guidance on securing OT environments. Since the utilities affected are private and specific technical details are not disclosed, general OT security best practices aligned with CISA recommendations are advised. Patch status is not yet confirmed — check CISA and relevant vendor advisories for current remediation guidance.