...
By Matt Cannon
News Editor
0
Share
Newsweek is a Trust Project member
See more of our trusted coverage when you search.Prefer Newsweek on Googleto see more of our trusted coverage when you search.
An Iran-linked hacking group claimed that it breached water systems in California, prompting an investigation by one of the state’s largest utilities—even as officials say there is no evidence the U.S. water supply was compromised.
The group, known as Handala, said it hacked systems tied to California Water Service (Cal Water) and accessed internal data, framing the cyber intrusion as retaliation for alleged recent U.S. strikes on Iranian water infrastructure amid the joint U.S.-Israel war with Iran that began on February 28.
Handala provided to Iranian news outlet Press TV what it said were screenshots of customer billing records and internal dashboards, and claimed it obtained about 5 gigabytes of data, specifically in Bakersfield, Visalia and Chico.
Read More on News
The hackers also warned they could have disrupted water supplies to American cities but deliberately chose not to, describing the operation as a “warning” to Washington.
“We could have easily cut off the water to American cities," the group said, according to Press TV.
...
Cal Water said on June 15 it was "working around the clock to investigate" the claims alongside state and federal government partners. No services were affected, it added.
“Our investigation remains ongoing, but our preliminary findings continue to indicate that there are no known operational disruptions to our water and wastewater systems, including the billing platform,” spokesperson Yvonne Kingman told nonprofit SJV Water. “We have no known operational disruptions to our water and wastewater systems.”
Cal Water told Newsweek via email on June 25 that a "robust investigation" involving cybersecurity group Mandiant found "activity was limited to unauthorized access to a small number of specific user accounts within two third-party service provider platforms."
"The investigation determined that the threat actor accessed one active customer’s online Cal Water account using stolen user credentials," Kingman said in a statement. "The customer account did not provide access to the billing system, and no payment information was compromised. The threat actor also accessed an external, third-party web site related to a GPS location correction tool; however, the website does not contain any confidential or sensitive information."
There have been heightened warnings from public health officials that foreign actors may target U.S. critical infrastructure in response to geopolitical tensions.
Earlier analysis by cybersecurity firm Dataminr said targeting water infrastructure "is consistent with Handala’s stated doctrine of attacking 'life-sustaining' systems for maximum psychological and societal impact.
"The dual-system breach pattern—accessing both an operational support network and a customer-facing database—reflects the group’s preference for high-visibility, multi-domain impact over quiet persistence," it said. "Analysts should note that Handala has no confirmed history of tampering with water treatment processes or chemical dosing systems in any previous operation; impact to date has been data exfiltration, wiper deployment, and psychological operations."
Strikes on Iran Water Supply
Iranian state media reported that U.S. air strikes last Wednesday destroyed a drinking-water facility near the Strait of Hormuz.
The U.S. Central Command said in a post on X around the time of the strikes that it conducted attacks near the strait “with precision munitions from U.S. Air Force and Navy fighter jets.”
“We are aware of reports and are looking into it,” U.S. Central Command spokesperson Tim Hawkins said on the day of the reported strikes.
Newsweek contacted U.S. Central Command via email on Tuesday for comment.
Update 6/10/26, 8 a.m. ET: Cal Water's update on Thursday was added.
Update 7/7/26, 8:52 a.m. ET: Cal Water's statement regarding the findings of the investigation were added.
View 0 Comments
Submit Correction
View Editorial & AI Guidelines