Colorado Water Utilities Hit by Cyberattacks Targeting OT Systems – SecurityWeek

Colorado Water Utilities Hit by Cyberattacks Targeting OT Systems  SecurityWeek

Foreign hackers breached OT systems at two Colorado water utilities, altering pumping cycles and disabling alarms without affecting safety. The hackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles, officials said. Hackers targeted operational technology (OT) systems at two private water utilities in Colorado in late August, apparently attempting to cause disruptions. Few technical details are available, but it seems the attackers targeted industrial control systems (ICS) at the water utilities, which serve fewer than 200 people. A spokesperson for Colorado Governor Jared Polis told The Denver Post [paywalled] that the attackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles. However, the disruptions were brief and did not affect water services or public safety.

The Colorado governor’s office has not named the affected utilities or said who is behind the attack, describing the attacker only as “foreign actors.” “We cannot confirm what foreign actors may have been involved, but we are aware of ongoing efforts across the nation by an Iranian-backed group to access drinking water and wastewater systems, as per the Cybersecurity and Infrastructure Security Agency,” the spokesperson said. Despite the mention of the Iran-linked attacks, it has not been confirmed that the Colorado utilities were targeted as part of the campaign that hit the water sector in at least a