[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5-WEjiPXx3OnDzNm86etClZgYQw1VT0eMDMbUvwopzE":3},{"article":4,"iocs":52,"watch_terms":57,"solutions":58,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"5ec46385-a70f-4351-9b24-76388e3e9bdc","Cal Water Investigating Iranian Hackers’ Claims","cal-water-investigating-iranian-hackers-claims-b2308f","California Water Service says there is no indication of operational disruptions to its water and wastewater systems. The post Cal Water Investigating Iranian Hackers’ Claims appeared first on SecurityWeek.","California Water Service (Cal Water) is investigating claims by the Iran-linked threat actor Handala, which alleges it stole several gigabytes of data from the utility. Handala, believed to be a front for Iranian government operations, claimed it could have disrupted water supply but chose to leak data including personal information from a customer billing database and an internal application. Cal Water stated that preliminary findings indicate no operational disruptions to its water and wastewater systems.","Cal Water is investigating claims by Iranian hackers Handala who allegedly stole and leaked data.","https:\u002F\u002Fwww.securityweek.com\u002Fcal-water-investigating-iranian-hackers-claims\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002Fwater-treatment-utility.jpeg","2026-06-16T11:53:11+00:00","2026-06-16T12:00:07.03283+00:00",8,[17,20,23,26],{"name":18,"type":19},"Handala","threat_actor",{"name":21,"type":22},"Cal Water","vendor",{"name":24,"type":25},"RTKBase","product",{"name":27,"type":28},"ICS","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":29,"icon":31,"name":32,"slug":33},null,"Nation-state","nation-state",[35,40,42,47],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53],{"type":54,"value":55,"context":56},"malware","ZionSiphon","Mentioned in related articles about ICS targeting in water facilities",[21,24],{"controls":59,"vendors":147},[60,89,118],{"slug":61,"name":62,"problem":63,"products":64},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":90,"name":91,"problem":92,"products":93},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"dragos","Dragos","\u002Fvendor-logos\u002Fdragos.png","dragos-platform","Dragos Platform","https:\u002F\u002Fwww.dragos.com\u002Fcybersecurity-platform\u002F","OT asset visibility, threat detection and response guidance for industrial environments.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-ot-security","Tenable OT Security","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fot-security","Asset inventory, vulnerability and threat detection for industrial networks.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"nozomi-networks","Nozomi Networks","\u002Fvendor-logos\u002Fnozomi-networks.png","guardian","Nozomi Networks Guardian","https:\u002F\u002Fwww.nozominetworks.com\u002Fplatform\u002Fguardian","Passive monitoring, asset inventory and threat detection for OT and IoT networks.",{"slug":119,"name":120,"problem":121,"products":122},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-incident-response","Truesec Incident Response","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fincident-response","Incident response team with a retainer option.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",[148],{"slug":149,"name":150,"logo_path":151,"roles":152},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png",[153],"reported_by",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":169},"iranian-hackers-claim-data-theft-from-california-water-utility","Iranian Hackers Claim Data Theft from California Water Utility","The Iran-linked threat actor Handala allegedly exfiltrated gigabytes of sensitive data from Cal Water, including personal information from a customer billing database and an internal application. This incident highlights the critical vulnerability of public utility infrastructure to nation-state actors who may prioritize data theft, extortion, or public disruption. The fact that attackers claimed they *could* have disrupted water supply but chose not to underscores the severe potential consequences of inadequate segmentation between IT (billing\u002Fcustomer) systems and operational technology (OT) systems. Critical infrastructure organizations must treat data breaches as potential precursors to physical or operational attacks, not isolated IT events.",[159,160,161,162,163,164,165,166,167,168],"NIST CSF PR.AC-5 (Network Integrity \u002F Segmentation)","NIST SP 800-82 (Guide to ICS\u002FOT Security)","CIS Control 3 (Data Protection)","CIS Control 12 (Network Infrastructure Management)","CIS Control 13 (Network Monitoring and Defense)","NERC CIP-007 (Systems Security Management for Critical Infrastructure)","GDPR Article 32 (Security of Processing)","GDPR Article 33 (Notification of Personal Data Breach)","NIST IR 8374 (Ransomware Risk Management)","ICS-CERT Recommended Practices for Securing Industrial Control Systems",{}]