Iran-linked Handala group claims breach of California water utility billing systems, no operational tech accessed
Customers of several California water utilities had billing data exposed after an Iran-linked group calling itself Handala claimed a breach and posted screenshots of water bills. Analysts say only billing systems and a GPS server were hit, with no sign water-treatment controls we
An Iran-linked hacking group calling itself Handala has claimed responsibility for breaking into IT systems at several California water utilities, publishing screenshots of customer water bills to back up the claim. According to security analysts reviewing the incident, the intrusion reached a customer billing database and a GPS correction server, both classified as non-critical IT rather than the operational technology that runs water treatment and distribution. So far there is no evidence that industrial control systems or the equipment that actually manages drinking water were accessed or disrupted. The exposed data appears to center on customer billing records rather than the controls that keep water safe and flowing. The breach lands against a tense backdrop. In April, the FBI and CISA issued a joint advisory warning that Iran-linked threat actors had targeted internet-facing devices at US water, energy and municipal sites, including programmable logic controllers made by Rockwell Automation $ROK and its Allen-Bradley brand. In some of those earlier cases, officials said the activity led to operational disruption and financial loss. Water systems have long been considered a soft target because many local utilities run on limited budgets and aging equipment, and hundreds of US systems have been found with weak security configurations. For now, the California incident looks confined to billing and administrative systems. Reported by the FBI, CISA and covered by Cybersecurity Dive.