DENVER — Foreign hackers breached two small Colorado water utilities last month, altering pumping cycles and disabling alarms, but treatment processes and water quality were not impacted — as far as the governor’s office knows.
The revelation by Gov. Jared Polis’ spokeswoman Ally Sullivan on Tuesday came just a day after UCHealth officials announced someone “intentionally disrupted” the oxygen supply at Colorado’s largest hospital earlier this month.
Both incidents were quickly discovered and there was no impact to public safety, according to officials from both agencies.
Though Sullivan did not identify which two water utilities were impacted by this breach in late August, she said in a statement to Denver7 that the breach involved two “small, private providers” that serve fewer than 200 people.
During the breach, the hackers changed equipment settings, disabled remote access and alarms and altered pumping cycles at both utilities, Sullivan said.
“To our knowledge, treatment processes and water quality were not impacted at either provider,” Sullivan said.
She explained the incidents were brief and that providers took quick action by notifying the State of “outside attempts to cause interference” and worked to prevent any further breaching attempts.
Aurora
UCHealth says someone ‘intentionally disrupted’ its primary oxygen supply
The Colorado Department of Public Health and Environment followed up with each provider to confirm the issue had been resolved, offered technical assistance and reached out to other water providers and partners throughout the Colorado Water/Wastewater Agency Response Network to help prevent similar instances at other water utilities, Sullivan said.
“We cannot confirm what foreign actors may have been involved, but we are aware of ongoing efforts across the nation by an Iranian-backed group to access drinking water and wastewater systems, as per the Cybersecurity and Infrastructure Security Agency,” Sullivan added.
The governor’s spokeswoman said heightened cybersecurity risks around drinking water and wastewater systems are not specific to Colorado, adding the State was actively monitoring national trends and threats.
She said the Colorado Information Analysis Center, which works to prevents acts of the terrorism at the state level, was working with the CDPHE on communicating with water utilities and providers to encourage them to double-check their security measures and make any necessary security updates.
Steve Beaty, a cybersecurity expert and professor of computer science at MSU Denver, said smaller utilities are often the most vulnerable to these kinds of attacks.
"With many small organizations, it's difficult to have full-time cybersecurity people on board, and so they are understaffed," Beaty said.
Beaty said smaller targets can be a stepping stone to larger ones.
"The small oftentimes are then prelude to attacks on bigger ones," Beaty said.
"They do some explorations at maybe what might be considered softer targets, and then go after larger targets, if you will," Beaty said.
The attacks add to a growing wave of cyber threats targeting water systems nationwide, according to the EPA. Colorado is now tracking these threats while working with utilities across the state — like Aurora Water.
Melissa Grove, Aurora Water's deputy director of water technology, said the utility works closely with federal partners to stay ahead of potential threats.
"We also work really closely with Department of Homeland Security and also the EPA, especially in regards to cybersecurity and the events that have been happening around the country," Grove said.
Aurora Water, like many other large utility providers, has a robust operational technology team to keep hackers from disrupting service, said Grove.
"We know these bad actors are out there for a reason. They know that if they can do damage to our critical infrastructure, water or electric, they can have a really big impact to the community, to our residents," she said.
Beaty said Colorado is better positioned than many states when it comes to technology, but cautioned that no system is completely secure — especially as technology and automated systems continue to evolve.
"The truth of the matter is, I think you can't be 100% because the threats change so quickly," Beaty said.
Grove echoed that warning.
"The threat is real. We need to make sure that we've got the right defense, the right layers of protection in place," she said.
Denver7 is committed to making a difference in our community by standing up for what's right, listening, lending a helping hand and following through on promises. See that work in action, in the videos above.