Foreign hackers broke into the computer systems of two Colorado water utilities last month, changing pumping cycles, disabling alarms and altering equipment settings before operators managed to regain control, state officials said Thursday.
The breaches did not affect drinking water quality or treatment processes, according to Gov. Jared Polis’ office. But they add Colorado to a growing list of states where water infrastructure has been targeted by hackers this year.
The Environmental Protection Agency says more than 100 drinking water and wastewater systems across 12 states have been hit by high-profile cyberattacks in 2026, a sign of how widely the threat has spread since federal officials first warned this summer that hackers were disrupting water operations nationwide.
It is not yet known who carried out the Colorado intrusions. Colorado officials have not identified the actors involved or said whether the attack is linked to the wider pattern of breaches seen elsewhere in the country. Previous attacks on U.S. water systems have been tied to groups affiliated with Iran, and China has also been suspected of involvement in cyber intrusions targeting American infrastructure.
Unlike some earlier incidents, no group has publicly claimed responsibility for the Colorado breach.
Polis spokesman Eric Maruyama said the intrusions at the two small systems were brief and handled quickly by the utilities themselves.
“These were brief incidents, and the risks were quickly addressed by the providers themselves, who subsequently alerted the state,” Maruyama said.
According to the governor’s office, the hackers disabled remote access and alarms, altered equipment settings, and changed pumping cycles at the two facilities before control was restored.
A Federal Response Still Playing Catch-Up
The EPA serves as the federal government’s sector risk management agency for water and wastewater systems and told Fox News Digital it is working with utilities, states and other federal partners to find vulnerabilities and shore up defenses.
Since fiscal year 2025, the agency says it has identified more than 900 vulnerabilities across over 650 water systems and helped eliminate roughly 700 of them at more than 500 utilities. The EPA has also conducted more than 710 cybersecurity risk assessments and provided direct technical assistance to approximately 15,900 utilities nationwide.
Even so, the pace and reach of these intrusions — more than 100 systems across a dozen states this year alone — raise questions about whether small, often underfunded local water utilities have the resources to keep pace with well-organized hackers, potentially backed by hostile foreign governments. With the source of the Colorado attack still unidentified, officials and residents alike are left waiting to find out whether it was an isolated incident or another data point in a larger, coordinated campaign against American infrastructure.
