Sage Energy Partners / Sage Water Resources (SWR), a Native American-owned water infrastructure company operating in the Uinta Basin of northeastern Utah, has disclosed that it was the target of a sophisticated cyberattack earlier this year, becoming one of the latest critical infrastructure operators to report intrusions attributed to foreign state-sponsored hackers.
The attack was detected on March 15, 2026, at its saltwater disposal facility in Duchesne, Utah. Forensic investigators working alongside federal law enforcement confirmed that an unauthorized actor had manipulated the logic of a Programmable Logic Controller (PLC), an industrial computer used to automate physical processes at the site.
SWR attributed the intrusion to an advanced nation-state threat actor and described it as part of a broader campaign targeting water and critical infrastructure operators across the United States. No physical damage or environmental harm was reported. The breach was initially spotted by a truck driver during early morning operations, prompting a rapid response from the company's operations team.
SWR attributed the intrusion to an advanced nation-state threat actor and described it as part of a broader campaign targeting water and critical infrastructure operators across the United States
Following the incident, SWR overhauled its network infrastructure with the help of automation firm Sasquatch Automation and federal cybersecurity partners, migrating from its legacy network configuration to an upgraded setup featuring an advanced PLC system protected by a Virtual Private Network (VPN).
"This incident underscores the reality that independent energy operators of critical infrastructure are on the front lines of global geopolitical threats," said Steve Crower, CFO, Secretary and Treasurer. "However, the SWR operations team response, combined with the support of world-class federal agents and our local private partners, has allowed us to bounce back stronger, safer, and fully hardened against future cyber security threats."
President and CEO Cleve Pike, a member of the Ute Tribe, emphasized the company's commitment to protecting both its workforce and the surrounding environment, including tribal lands.
SWR did not name the nation-state it believes was responsible for the attack. Federal law enforcement agencies involved in the response were not identified in the company's disclosure.
