Colorado officials confirmed the intrusions on Thursday, placing the state alongside Minnesota and other jurisdictions now investigating a summer-long wave of attacks. The affected utilities were privately owned and each served fewer than 200 people. According to the office of Governor Jared Polis, drinking-water quality and treatment processes were not compromised.
Analyst Insight — The “small utility” blind spot: The Colorado victims were tiny, privately held systems serving under 200 residents each. Small utilities collectively represent the overwhelming majority of U.S. water providers, yet many lack dedicated cybersecurity staff, accurate asset inventories, or the budget to replace legacy PLCs. Attackers appear to understand this arithmetic better than some regulators do: operational impact no longer requires a large target.
State officials said the attackers manipulated equipment used to control drinking-water systems. Reported effects included modified pumping cycles, disabled alarms and altered settings on PLC-driven equipment. Operators ultimately regained control, and no threat to drinking-water safety was reported.
The timing is difficult to ignore. The Colorado breaches landed just weeks after federal agencies warned that “malicious cyber actors” were targeting water and wastewater sector PLCs, and only days after a comparable wave struck more than 30 community water systems in Minnesota.
Federal agencies reported that attackers remotely accessed internet-facing controllers and tampered with configurations, in some cases causing utilities to lose monitoring or control capabilities. Documented operational effects ranged from loss of water pressure to flooding — consequences that turn a cybersecurity event into a public-safety emergency.
Why Internet-Facing PLCs Remain the Weak Link
The technical root cause is structural rather than exotic. Water treatment and distribution rely on PLCs that manage pumps, valves and dosing systems — equipment often installed a decade or more ago and never designed for a connected world. When those controllers are reachable from the public internet, the attack surface becomes global.
Federal advisories describe threat actors using legitimate engineering software to connect to misconfigured controllers and extract project files, rather than deploying bespoke malware. That approach leaves a faint forensic trail and exploits the very tools engineers rely on every day.
Threat Databox: The PLC Attack Playbook
-
Targeted controllers: Rockwell Automation/Allen-Bradley CompactLogix, Micro850, and MicroLogix 1100 & 1400; Schneider Electric BMX P34 and Modicon M340; Siemens SIMATIC S7-1200.
-
Tools abused: Legitimate engineering platforms — Studio 5000 Logix Designer, EcoStruxure Control Expert and Siemens TIA Portal — launched from leased third-party infrastructure.
-
Observed tactics: Password changes that lock operators out, IP address rewrites that disconnect controllers, and exfiltration of PLC project files.
-
Attribution signals: Federal advisories describe an Iranian-affiliated campaign active against U.S. critical infrastructure since at least March 2026, spanning water and wastewater, energy, government and municipal organizations.
-
Known exploited flaw: CVE-2021-22681 (Rockwell/Allen-Bradley controllers) was added to CISA’s Known Exploited Vulnerabilities catalog on March 5, 2026.
Market Statistics: The Exposed Attack Surface
- 4,407 internet-facing industrial controllers were observed exposing port 44818 (EtherNet/IP).
- Roughly 65% of those exposed controllers were located in the United States, followed by Canada (12%) and Spain (3%).
- Exposed controller counts fell 47%, from a March 2020 high of 7,814 to a June 2026 low of 4,169 — measurable progress, but still thousands of open doors.
- A July 30, 2026 census counted 4,148 Rockwell/Allen-Bradley EtherNet/IP hosts, 4,117 Siemens SIMATIC S7-1200 hosts and 2,072 Schneider Electric hosts exposed.
- Federal advisories note that targeting affects water entities of all sizes, including organizations with mature cybersecurity programs.
Market Trends — Security Becomes a Procurement Criterion: The attack campaign is quietly reshaping buying behavior across the automation supply chain. Utilities and integrators are prioritizing controllers with secure-by-design features, secure remote-access gateways and jump hosts, managed OT security services, and aggressive life-cycle refresh of unsupported firmware. Expect network segmentation, multi-factor authentication and geo-fencing to move from “best practice” to line-item budget requirements — and expect legacy PLC replacement to be framed as a resilience investment, not an IT cost.
The Federal Response and Regulatory Push
CISA, the FBI and the EPA have issued a sequence of advisories urging owners and integrators to remove publicly exposed PLCs from the internet “as soon as possible.” The guidance is blunt: remote access should pass through a VPN or gateway, never directly to the controller.
Officials have also stressed a low-tech safeguard that is easily overlooked — the ability to operate systems manually. Business continuity plans, fail-safe mechanisms, backups and standby systems should be routinely tested so that a compromised network does not automatically mean a compromised water supply.
What Utilities and Integrators Should Do Now
The remediation list is neither expensive nor novel, which makes the persistence of these breaches all the more striking. Most incidents trace back to exposure and credential hygiene rather than cutting-edge exploits.
Mitigation Checklist for OT and PLC Teams
-
Remove inbound exposure: Disconnect PLCs from the public internet; mediate all access through a secured gateway or jump host.
-
Harden credentials: Enable password protection, change all default passwords, and enforce multi-factor authentication for OT access.
-
Allowlist access: Permit remote connections only from known engineering laptops and critical OT assets.
-
Segment the network: Deploy a DMZ or bastion host at the OT boundary and enforce segmentation across sites.
-
Audit hidden pathways: Identify undocumented cellular modems added by operators, vendors or integrators — a commonly overlooked blind spot.
-
Preserve manual control: Test the ability to revert to manual operations quickly and safely.
-
Patch and retire: Prioritize remediation of known exploited flaws and plan for replacement of controllers running unsupported firmware.
Frequently Asked Questions
Were Colorado residents’ drinking water put at risk?
State officials said water quality and treatment processes were not affected. The attackers manipulated control equipment, not the water itself.
Who was responsible?
Officials have not confirmed the actors’ identities. The incidents follow a pattern consistent with earlier federal advisories describing an Iranian-affiliated campaign against U.S. critical infrastructure.
Are only small utilities targeted?
No. Federal guidance states the activity targets water entities of all sizes, including those with mature cybersecurity programs.
What hardware is most exposed?
Internet-facing controllers from Rockwell Automation/Allen-Bradley, Siemens and Schneider Electric have all featured in advisories and exposure analyses.
What is the single most effective step?
Removing PLCs from direct internet exposure and routing all remote access through a monitored gateway remains the highest-impact mitigation.
The Bottom Line: PLC Security Is Now a Public-Safety Mandate
The Colorado breaches are not an anomaly but a recurring pattern with a predictable trigger: internet-exposed controllers running aging firmware. As long as thousands of PLCs remain reachable from the public network, the next incident is a question of when, not if.
For utilities, integrators and automation buyers, the strategic takeaway is unambiguous. Operational technology is no longer a back-office concern — it is a public-safety mandate, and the economics of defense are far cheaper than the consequences of disruption.
