Cybersecurity breach affected two small Colorado water providers, governor says

STATEWIDE, Colo. (KRDO) -- Colorado Gov. Jared Polis says "foreign actors" were involved in a cybersecurity incident that impacted two small, private water providers that serve less than 200 people.

The governor's office says it can't confirm what actors may have been involved, but it is aware of efforts from an Iranian-backed group to access drinking water and wastewater systems. They cited information from the Cybersecurity and Infrastructure Security Agency.

The governor's office says the water service providers were notified in late August and quickly took action. Officials say the Colorado Department of Public Health and Environment then followed up with the providers to confirm the issue had been resolved.

Officials say the issues involved equipment settings changed, disabling remote access and alarms and alternating pumping cycles. The governor's office says they don't believe any treatment processes or water quality were impacted.

The governor's office did not say which providers were impacted.

A full statement from a spokesperson for the governor can be found below:

“Governor Polis has been briefed on threats to critical infrastructure and is closely following efforts in Colorado to improve security. The two water utilities impacted are small, private water providers that serve fewer than 200 people. The providers acted promptly and there was no impact to public safety or water services. We cannot confirm what foreign actors may have been involved, but we are aware of ongoing efforts across the nation by an Iranian-backed group to access drinking water and wastewater systems, as per the Cybersecurity and Infrastructure Security Agency. As required by state regulations, the water service providers notified the State of outside attempts to cause interference in late August, and the providers took quick action to address the incidents and prevent any further interference. After being notified, CDPHE followed up with each provider to confirm the issue had been resolved, offered technical assistance as needed, and shared information with other water providers and partners through the Colorado Water/Wastewater Agency Response Network to help prevent similar instances at other water providers.  

These two incidents consisted of individuals changing equipment settings, disabling remote access and alarms, and altering pumping cycles. These were brief incidents and the risks were quickly addressed by the providers themselves, who subsequently alerted the state. To our knowledge, treatment processes and water quality were not impacted at either provider.

Heightened cybersecurity risks around drinking water and wastewater systems are not specific to Colorado. The state is actively monitoring national trends and threats, and the Center Information Analysis Center and Colorado Department of Public Health and Environment are communicating with Colorado providers, encouraging them to double-check their security measures and make any necessary security updates.”

Stay up to date with the latest local news, sports, and investigations by downloading the KRDO13 app. Click here to download it from the Apple App Store. Android users can download it from Google Play here.