It Happened Again: Colorado's Water Breaches Exploit the Path That Should Never Have Existed

Key Takeaway: After successfully breaching two Colorado water utilities, attackers changed equipment settings, altered pumping cycles, disabled alarms, and cut off remote access. The same technique was used as the Minnesota and Michigan attacks. The attack path hasn't changed since; nor will the outcome until the inbound path is physically removed.

On September 17, Colorado officials disclosed that foreign actors had breached the control systems of two privately owned water utilities in August. The attackers changed equipment settings, altered pumping cycles, disabled alarms, and disabled remote access. Operators regained control, and the governor's office confirmed that drinking water quality and treatment processes were not affected. The two systems serve roughly 400 people between them.

With only 400 people being served by the facilities, no contamination, and a brief intrusion, it would be easy to label it as a minor incident. But then you look at what has really happened: attackers reached equipment that moves water, a physical, critical process, and turned off the alarms that alert response teams when something is wrong. In August 2026, more than 30 Minnesota community water systems and nine Michigan systems were hit in a coordinated campaign. The argument then was that the attackers hadn't done anything sophisticated. They found controllers reachable from the open internet and walked in. Colorado is proof of that argument repeating itself six weeks later. And the argument will probably repeat itself multiple times, as Colorado, Minnesota, Michigan are part of list of at least a dozen states whose water facilities were attacked, with the EPA (Environmental Protection Agency) now counting cyberattacks against more than 100 drinking water and wastewater systems.

In case of a data breach, an attacker would be stealthy about their actions and hide until they hit the jackpot. In Colorado’s case, the attacker disabled the alarm, effectively removing the operator's ability to see the process while it is being manipulated. Detection tooling, monitoring dashboards, and response playbooks all rely on a signal. Turn off the signal, and every downstream control degrades with it.

This is the structural weakness of a security model built on watching. Monitoring is necessary, but it doesn't do anything to keep attackers out.

Industrial traffic largely falls into two categories:

• commands going into a process
• operational data coming out of it

A small water utility sending telemetry, alarms, and historian data to a monitoring service needs the second (outbound data). It very often does not need the first (inbound connectivity).

Where that is true, inbound connectivity becomes a pure attack surface, adding unnecessary risks while delivering no operational reward.

In terms of protection, federal guidance rules recommend firewalls and VPNs, which do come with their own merits. But pieces of software can’t become the only boundaries between critical infrastructure and malicious intent. Software is configurable and hackable. Both firewalls and VPNs assume some inbound path remains open.

This is the core advantage of a hardware-enforced unidirectional gateway: it removes the return path as a matter of physics rather than policy. There is no rule to misconfigure, no port left open, no credential to steal, and no firmware to patch under pressure. It’s a physics rule as unbreakable as gravity is.

MetaDefender NetWall™ (data diodes) enforce the unbreakable rule via one-way data flow in hardware and optical connections. Operators keep full visibility into the operation network. Attackers get locked out. Applied to the Colorado systems, telemetry and alarms would still have left the network. The path the attackers used to reach the pumps would not have been there to find.