Cal Water Investigating Iranian Hackers’ Claims
Cal Water is investigating claims by Iranian hackers Handala who allegedly stole and leaked data.
California Water Service (Cal Water) is investigating claims by the Iran-linked threat actor Handala, which alleges it stole several gigabytes of data from the utility. Handala, believed to be a front for Iranian government operations, claimed it could have disrupted water supply but chose to leak data including personal information from a customer billing database and an internal application. Cal Water stated that preliminary findings indicate no operational disruptions to its water and wastewater systems.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Cal Water?
Get an email when a new story names Cal Water, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Iran-linked threat actor Handala allegedly exfiltrated gigabytes of sensitive data from Cal Water, including personal information from a customer billing database and an internal application. This incident highlights the critical vulnerability of public utility infrastructure to nation-state actors who may prioritize data theft, extortion, or public disruption. The fact that attackers claimed they *could* have disrupted water supply but chose not to underscores the severe potential consequences of inadequate segmentation between IT (billing/customer) systems and operational technology (OT) systems. Critical infrastructure organizations must treat data breaches as potential precursors to physical or operational attacks, not isolated IT events.
What helps against this
How we list vendors
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- OT and industrial control system security
Factory, building and utility control systems get visibility and protection.
- Incident response retainer
Experts are on call before the worst day, not searched for during it.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — ZionSiphon