The Warning They Declined

A story ran this week about two water utilities in Colorado that foreign hackers walked into last month. The reporting is accurate as far as it goes. What it does not say is that we had already sat across the table from those operators, shown them how someone would get in, and offered to close the gap. They said no. Weeks later, someone else said yes for them.

What happened

In August 2026, two small Colorado water systems serving roughly 400 people between them were breached. The intruders did not touch the water. They touched the controls. They reached the programmable logic controllers directly, the boxes that run the pumps and valves, then turned off alarms, cut remote access, changed pumping cycles, and altered equipment settings. The utilities regained control and alerted the state. Colorado says drinking water quality and treatment were not affected.

The part that did not make the report

Roughly two months ago, before any of this, we reached out to water operators in Colorado and walked them through this precise failure mode: control systems reachable from outside, remote access with nothing watching it, and no alarm when the settings change underneath you. The two utilities compromised in August are among the operators we had contacted. We named the exposure. We offered to fix it. They told us their IT team was handling it and they did not need us. That is the sentence that ends most of these conversations, and it is the wrong one: the team that patches the laptops does not watch a PLC, and the tools that guard the office network never see the control network at all.

We are not naming the utilities, and we are not going to. They are small, they are under-resourced, and they made the same call that hundreds of systems like them make every week. The point is not who they are. The point is that the exposure was findable, because we found it, and it was preventable, because we offered to prevent it.

Why this was predictable

None of it required a nation-state. It required a scan. A small utility runs its plant with a skeleton crew and keeps the controls online so a couple of operators can reach them from home. That is reasonable. What makes it dangerous is the rest of the pattern that tends to travel with it: the controllers are reachable from further away than anyone intends, the remote path has no monitoring on it, and nothing raises a hand when a pump schedule or an alarm threshold is quietly rewritten.

An attacker does not need inside knowledge to find that. A scan finds it, which means the defender can find it first, and the fix is rarely exotic. It is knowing what is exposed, watching the control layer the way IT has watched the office network for twenty years, and getting told the moment something changes.

This is a pattern, not a bad week

Colorado is not an outlier. The water sector is being mapped, system by system.

These are not sophisticated campaigns against hardened targets. They are a wide, patient sweep of the softest infrastructure a country has, and the water sector is soft because it was never funded to be anything else.

What actually stops it

• Watch the OT, not just the IT. Monitor the control network and the controllers themselves, and alert when settings, alarms, or pump logic change. That is exactly the signal these operators lost the night they were breached.
• Find the exposure before an adversary does. A fixed-scope OT exposure assessment maps what is reachable, from where, and what has nothing watching it. It is the same scan the attacker runs, done for your side first.
• See the radio layer nobody else does. Rural water sites report over control radio that sits in front of the firewall and never appears on the internet. Baseline that spectrum and flag a rogue transmitter, a jammer, or a link that suddenly moved.
• Put it on one timeline. Wired telemetry and the radio layer land in one place, so a command and its effect on the plant line up, and an operator sees the whole picture instead of half of it.