Iran-Linked Hacking Group Handala Claims Breach of California Water Service, Leaks 5GB of Data The Iran-affiliated threat actor Handala has claimed responsibility for a cyberattack on California Water Service (Cal Water), one of the largest investor-owned water utilities in the U.S., serving roughly two million customers across 100 communities in California. The group published 5GB of stolen data, alleging retaliation for recent U.S. actions in Iran and asserting it had the capability to disrupt water access but opted against doing so. According to Dataminr, the attack likely began with the compromise of Cal Water’s RTKBase instance, a GNSS base station platform, which served as an initial access vector or lateral pivot point to the utility’s billing system. The Chico District was confirmed as the target, with leaked data including a customer billing database and internal RTKBase application details. The RTKBase instance had been operational for 783 continuous hours at the time of access, with GPS correction data streamed across seven district mountpoints. The exposed data contains personally identifiable information (PII), such as names, addresses, phone numbers, account numbers, and payment histories, along with administrative credentials for the RTKBase platform and NTRIP source passwords. While no operational technology (OT) or industrial control system (ICS) disruption has been confirmed, Handala’s toolkit includes custom wipers (win.handala, Handala Wiper, Hamsa Wiper) and MBR-overwriting capabilities, indicating potential for destructive follow-on attacks. Handala, linked by the U.S. to Iran’s Ministry of Intelligence and Security (MOIS), has been active since at least 2008 and is also tracked under aliases including Banished Kitten, Void Manticore, and Red Sandstorm. The group is known for data exfiltration, wiper malware deployment, and psychological operations, often escalating from theft to destructive attacks within the same campaign. Previous incidents include the Stryker attack and a recent cyberattack on LA Metro. Cal Water has not publicly acknowledged the breach, and security experts recommend treating the incident as a potential precursor to further destructive activity. All exposed credentials should be considered compromised, and affected systems require immediate auditing and remediation.

Iran-Linked Cyberattack Targets Bay Area Water Utility in Escalating Infrastructure Threats An Iran-affiliated hacking group has claimed responsibility for a cyberattack on California Water Service (Cal Water), the Bay Area-based utility providing clean water across the state. While Cal Water confirmed the incident did not disrupt water or wastewater systems, the breach underscores growing risks to critical infrastructure as geopolitical tensions spill into cyberspace. The attack, part of an ongoing campaign by Iranian actors, appears to serve as both a demonstration of capability and a warning, according to cybersecurity experts. Tony Sabaj of Check Point Software noted the group’s intent to signal vulnerability, framing such strikes as potential acts of terrorism where disruptions to essential services like water could incite fear and widespread harm. The incident reflects a broader shift in cyber warfare, with state-backed groups increasingly targeting U.S. infrastructure amid evolving security defenses. UC Santa Cruz lecturer Chris Hables Gray warned that rapid digitization and overreliance on AI often without adequate safeguards amplify these risks, as automated systems may lack the resilience to counter sophisticated threats. Cal Water, headquartered in San Jose, is continuing its investigation, though no operational impact has been reported. The attack follows a pattern of Iranian cyber operations against American targets, marking critical utilities as a new front in an escalating digital conflict.