Cal Water Finds No Evidence of OT Activity After Hackers Claimed They Could Disrupt Water Supply
Cal Water finds no OT activity after hackers claimed disruption capabilities.
California Water Service (Cal Water) has concluded its investigation into a cyberattack claimed by the Iranian hacker group Handala. The investigation, aided by Mandiant, found no evidence of threat actor activity within Cal Water's operational technology (OT) or internal information technology environments. While Handala claimed to have accessed industrial control systems and could have disrupted the water supply, the investigation revealed the activity was limited to unauthorized access of user accounts on two third-party platforms, including a customer's online account and a GPS tool website.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Mandiant?
Get an email when a new story names Mandiant, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Handala group's claims of disrupting water supply infrastructure were ultimately traced back to unauthorized access of user accounts on two third-party platforms, not Cal Water's operational technology systems. This highlights a critical risk vector: third-party tools and platforms can serve as entry points that attackers attempt to leverage for reputational damage or as staging grounds for deeper intrusion. While the outcome here was contained, the incident underscores how threat actors can exploit weak access controls on external platforms to create the appearance of a more severe attack. Critical infrastructure operators must treat every third-party platform with the same security rigor as internal systems, since a compromised vendor account can still expose sensitive operational data or serve as a pivot point.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- OT and industrial control system security
Factory, building and utility control systems get visibility and protection.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Handala