Iranian Attack on US Water Supply Triggers Investigation

An Iran-linked hacking group named Handala claimed responsibility for breaching systems tied to California Water Service (Cal Water), accessing internal data in Bakersfield, Visalia, and Chico. The group provided screenshots of customer billing records and internal dashboards to Iranian state media, stating it obtained about 5 gigabytes of data as retaliation for recent U.S. strikes on Iranian water infrastructure amid ongoing U.S.-Israel tensions with Iran. The hackers warned they could have disrupted water supplies but deliberately chose not to, describing the operation as a warning to the U.S. Cal Water confirmed it was investigating the claims alongside state and federal partners, stating no operational disruptions to water or wastewater systems occurred. Spokesperson Yvonne Kingman said preliminary findings indicated no known issues with water treatment or distribution, though the investigation remains ongoing. Independent cybersecurity analysis by Dataminr suggested Handala accessed a customer billing database—including names, addresses, phone numbers, account details, and payment history—as well as an internal GPS-based infrastructure monitoring system. Neither system directly controls water treatment or distribution, though analysts noted Handala’s focus on high-visibility breaches for psychological impact. The group has no confirmed history of tampering with water treatment processes in past operations. The U.S. Central Command previously acknowledged conducting precision airstrikes near the Strait of Hormuz on April 23, targeting Iranian water infrastructure. Iranian state media reported the strikes destroyed a drinking-water facility, escalating tensions in the region. Public health officials have issued warnings about potential foreign threats to U.S. critical infrastructure amid heightened geopolitical risks. Cal Water’s spokesperson reiterated that no services were affected and that the company was working with government partners to assess the breach. The incident follows broader concerns about cyber threats to American utilities, particularly as foreign actors exploit tensions in the Middle East.