Hackers targeted operational technology (OT) systems at two private water utilities in Colorado in late August, apparently attempting to cause disruptions.
Few technical details are available, but it seems the attackers targeted industrial control systems (ICS) at the water utilities, which serve fewer than 200 people.
A spokesperson for Colorado Governor Jared Polis told The Denver Post [paywalled] that the attackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles. However, the disruptions were brief and did not affect water services or public safety.
Hands-On Cyber-Physical Systems Training at ICS Cybersecurity Conference
The Colorado governor’s office has not named the affected utilities or said who is behind the attack, describing the attacker only as “foreign actors.”
“We cannot confirm what foreign actors may have been involved, but we are aware of ongoing efforts across the nation by an Iranian-backed group to access drinking water and wastewater systems, as per the Cybersecurity and Infrastructure Security Agency,” the spokesperson said.
Despite the mention of the Iran-linked attacks, it has not been confirmed that the Colorado utilities were targeted as part of the campaign that hit the water sector in at least a dozen states across the United States in July.
While federal authorities have not released a complete list of affected utilities, confirmed targets span facilities in Minnesota, Michigan, Georgia, South Dakota, New Jersey, Wisconsin, and Alabama.
CISA urged the water sector to secure OT in light of these attacks. The cybersecurity agency said it is aware of 100 internet-exposed water systems targeted in cyberattacks in July.
Independent security group Infracritical has established a central repository aggregating technical indicators and operational data from the recent water sector breaches.
Related: US Water Systems Get Cyber Boost From New Senate Bill and ‘Water Watch Center’
Related: Cyberattacks on Two Oil Tankers Prompt Coast Guard, FBI to Board Vessels
Related: Ransomware Attacks on Manufacturers Surge as Supply Chain Risk Grows
