What OT security is — hackers changed pump cycles at Colorado water utilities
OT security protects operational technology, the computers that run physical equipment such as pumps, valves and circuit breakers, as opposed to IT systems that handle data. When IT is breached, data leaks; when OT is breached, machinery moves. In late August 2026 foreign hackers broke into two small private water utilities in Colorado that together serve fewer than 200 people. They changed equipment settings, disabled remote access and alarms, and altered pumping cycles. The disruptions were brief and water quality was not affected. The incident followed a July campaign that targeted more than 100 internet-exposed water systems in at least a dozen US states
The three lines
- Definition — security for computers that move physical equipment; IT breaches leak data, OT breaches move machinery
- Case — two small Colorado water utilities in late August 2026: settings changed, remote access and alarms disabled, pumps altered
- Backdrop — a July campaign hit more than 100 internet-exposed water systems in at least 12 states; small sites lack security staff
Key questions
- How is OT different from IT
- **IT handles information; OT moves things.** | | IT | OT | |---|---|---| | Handles | documents, email, payments | pumps, valves, motors, breakers | | Typical devices | servers, PCs | PLCs (controllers), HMIs (operator screens), SCADA (remote supervision) | | If breached | data theft, ransomware | **equipment malfunction, physical harm** | | Priority | confidentiality | **availability and safety** — it must not stop | | Replacement cycle | 3–5 years | **15–30 years** | | Patching | frequent, automatic | rare — a reboot halts the process | **The last two rows are the core difficulty.** Water-plant controllers run for decades, and updating them means interrupting supply, so known flaws can sit unpatched for years.
- What happened at the Colorado water utilities
- **Attackers manipulated equipment directly through operator systems**, according to Colorado Governor Jared Polis's office. | Item | Detail | |---|---| | When | **late August 2026** | | Targets | **two small private water utilities** in Colorado | | Scale | together serving **fewer than 200** people | | Actions | changed settings, **disabled remote access**, **disabled alarms**, **altered pumping cycles** | | Impact | brief disruptions; **no effect on service or water quality** | | Attribution | state officials said only **foreign actors** | **The alarm and remote-access steps matter most.** The attackers changed equipment while cutting off the operators' ability to notice and reverse it. Security analysts describe this as a shift from defacement to **manipulating physical processes and blinding safety monitoring.**
- Why are small water systems targeted
- **They are exposed online and nobody is guarding them.** | Reason | Detail | |---|---| | Internet exposure | operator screens connected online for remote convenience | | Default passwords | factory credentials left unchanged | | Staffing | a handful of employees, no security specialist | | Budget | little money for upgrades | | Propaganda value | even a tiny site lets attackers claim they hit US water | **The July campaign shows the scale.** At least **a dozen states** — including Minnesota, Michigan, Georgia, South Dakota, New Jersey, Wisconsin and Alabama — saw **more than 100 internet-exposed water systems** targeted. Colorado officials said they were aware of an ongoing effort by an Iranian-backed group to access water and wastewater systems nationwide, but did not confirm the Colorado incident was part of it.
- How is OT secured
- **Step one is getting it off the internet.** The US Cybersecurity and Infrastructure Security Agency repeatedly urges water utilities to follow these basics. | Practice | What it stops | |---|---| | disconnect HMIs from the internet | direct remote manipulation | | change default passwords | the most common way in | | require VPN and multi-factor for remote access | reuse of stolen passwords | | separate IT and OT networks | office infections spreading to equipment | | keep manual operating procedures | recovery when controls are compromised | | log and alert on setting changes | early detection | **The last row is exactly what was attacked in Colorado.** The hackers switched off the alarms first. If alarms sit on the same network as the controls, they fall together — so logging and alerting should run on a **separate path**.
The hackers did not change a file. They changed when the pumps ran — and switched off the alarms that would have told anyone.
1. Definition — OT versus IT
Operational technology (OT) is the hardware and software that monitors and controls physical equipment: water pumps, power breakers, factory robots, building climate systems. OT security protects it.
| IT security | OT security | |
|---|---|---|
| Protects | data | processes and equipment |
| Worst case | leaks, ransomware | physical accidents, public-service outages |
| Core value | confidentiality | availability and safety |
| Device life | 3–5 years | 15–30 years |
| Updates | constant, automatic | rare — stopping means shutting down |
OT's weakness is that it runs for decades and cannot easily stop.
2. The parts that get attacked
| Name | Role | Analogy |
|---|---|---|
| PLC | controller that switches equipment | hands |
| HMI | operator screen | dashboard |
| SCADA | remote supervision across sites | control room |
| Alarms | signal abnormal conditions | emergency bell |
In Colorado the attackers moved the hands, silenced the bell and locked the control room out.
3. Cases — Colorado and before
| When | Where | What happened |
|---|---|---|
| February 2021 | Oldsmar, Florida | remote attempt to change sodium hydroxide dosing, reversed at once by an operator |
| November 2023 | Aliquippa, Pennsylvania | Iran-linked group defaced a water booster station controller |
| July 2026 | at least 12 US states | more than 100 internet-exposed water systems targeted |
| Late August 2026 | Colorado | settings changed, remote access and alarms disabled, pump cycles altered |
The trend runs from defacing screens to manipulating processes. In 2023 attackers posted a message; in 2026 the equipment behaved differently, and monitoring went dark first. Water quality was not affected.
4. Why small systems are at risk
The US has roughly 50,000 community water systems, most of them small. The two Colorado utilities serve fewer than 200 people combined. They are not too small to target; they are too small to defend.
| Weakness | Result |
|---|---|
| no security staff | intrusions noticed late |
| reliance on remote management | operator screens open to the internet |
| default passwords | the easiest door |
| thin budgets | equipment upgrades delayed for decades |
5. How to defend
- Take it off the internet. An operator screen that can be found will be targeted.
- Change default passwords.
- Put remote access behind VPN and multi-factor authentication.
- Separate IT and OT networks.
- Run alarms and logs on a separate path — they were the first thing switched off in Colorado.
- Keep manual procedures, so people can turn valves if controls fail.
6. What remains unconfirmed
- The utilities' names and the intrusion route have not been released.
- Attribution is limited to foreign actors; any link to the Iranian-backed campaign is unconfirmed.
- Related explainers: 「What a botnet is」, 「What a zero-day is」.
Sources
- SecurityWeek — Colorado water utilities hit by cyberattacks targeting OT systems
- Industrial Cyber — Colorado water utilities face foreign cyberattacks targeting pumps, alarms and remote access
- Axios Denver — Foreign actors breach Colorado water systems
- Wikipedia — Operational technology
- CISA — Water and Wastewater Sector Cybersecurity