Last month, two water utilities in Colorado were breached by foreign actors who changed pumping schedules, shut off alarms and adjusted equipment settings. Operators took back control of both systems, and neither drinking water quality nor treatment processes were harmed, according to Gov. Jared Polis’ office.
This attack adds Colorado to a rising number of assaults on U.S. water and wastewater infrastructure. So far this year, more than 100 drinking water and wastewater systems across 12 states have been targeted, according to Fox News Digital. The breaches included remote access, disabling alarms and altering configurations.
These systems in Colorado support roughly 400 individuals, according to available figures. State officials say the threats were promptly handled by the providers themselves, who notified the governor’s office.
The scope of the national threat
In July, federal authorities issued a warning about malicious actors aiming to compromise internet-connected operational technology used by water and wastewater utilities. The FBI and EPA reported that utilities in at least seven states had reported incidents, with some of those attacks degrading water operations.
Remote attackers gained access to PLCs exposed on the internet and altered device settings. The reported consequences included reduced water pressure and flooding.
Fox News Digital reports the EPA is collaborating with utilities, states and federal partners to spot weak points and bolster cybersecurity. The agency says it has found more than 900 security weaknesses in over 650 water systems since fiscal year 2025. It has also worked with more than 500 utilities to remove about 700 of those flaws.
The EPA has carried out over 710 cybersecurity risk assessments and supplied direct technical support to roughly 15,900 water providers. That figure reflects the scale of daily operation across the country, with thousands of systems running simultaneously.
The Iranian angle
Investigators looked into whether Iranian individuals or hackers tied to Iran were responsible for the attacks in Minnesota. The president disputed that the attacks could be attributed to Iran, pointing instead at Minnesota officials.
Since fiscal year 2025, the EPA’s record of work has made plain the scale of the trouble, with more than 900 weaknesses found across 650 systems. Day-to-day operators of 15,900 water systems appear to be receiving hands-on help from the EPA, which points to the agency working directly with those who run these systems on a regular basis.
What the EPA says it is doing
Federal partners, states and utilities are being worked with by the EPA to spot weak points and build up cybersecurity.
| Agency | Role |
|---|---|
| EPA | Identifying vulnerabilities, conducting risk assessments, providing technical assistance |
| FBI | Investigating incidents, examining Iranian ties |
| Utilities | Addressing risks themselves, alerting the state |
Government action at the national level has become essential, despite the added intrusion into areas that previously operated independently. The risks involved make any other approach impossible to justify.
Where the paper stands
The paper backs the operators who regained control of both systems and is against any agency or office that writes its own authority over private infrastructure. The Colorado breach was handled by the providers themselves, who took back control and restored normal operation without harm to water quality or treatment processes. That is the model the paper prefers.
The EPA’s role in identifying weaknesses and offering technical support is useful information, but the paper is wary of any office gathering authority over private systems. The story shows what happens when control stays with the people who run the systems, not with Washington. The paper wants to see more of that.
The EPA’s work with thousands of providers, finding hundreds of flaws and removing hundreds more, is a real contribution. But the paper will watch closely as the agency’s reach grows, to ensure no single office accumulates too much power over the systems that serve us.
Source material: “Foreign hackers breach two more US water utilities, threaten safety of Colorado residents,” Fox News.
Get the Notebook.
The day's best stories and every fresh verdict, in plain English, in your inbox by seven. One email a day, no more.