Iran-linked Handala claims a California water utility hack, and the utility finds no sign of control-system access
June 11, 2026 (Claimed June 11, 2026)
The Iran-linked group Handala claimed in June that it had breached California Water Service, a utility serving about two million customers, published 5 GB of data and said it could have disrupted water supply but chose not to. Dataminr reported that the data pointed to a customer billing database and an internal GNSS base-station application, and that the Chico District was a confirmed victim. Cal Water brought in Mandiant and later said it found no evidence of activity in its operational technology environment, and that the actor accessed one active customer's online account using stolen credentials. Analysts note that Handala has a record of overstating its capabilities. The US links Handala to Iran's intelligence ministry, and the group framed the claim as retaliation for US strikes in Iran.
Why it matters
It shows how a claim about water systems can run ahead of the evidence: the data came from business systems, not plant controls.
What defenders can take from it
- Treat attacker claims about utilities as unverified until the utility or investigators confirm them.
- Protect customer-portal accounts with multi-factor authentication, and keep billing and IT networks separate from control systems.