Key facts
- The hacker group Handala claimed responsibility for a cyber intrusion into California water facilities.
- Handala stated the breach was retaliation for alleged US strikes on Iranian water infrastructure.
- The group claimed to have obtained data and issued a warning to Washington.
- Handala stated they refrained from disrupting water supplies, citing an ethical code.
- Screenshots released by Handala appear to show access to network management interfaces in several California cities.
- US agencies warned that Iranian-linked hackers, CyberAv3ngers, are disrupting PLCs at U.S. water and energy facilities.
The hacker group Handala has claimed responsibility for a cyber intrusion targeting water facilities in California, asserting the action was a retaliation for alleged US strikes on water infrastructure in southern Iran. The group stated it obtained data from the systems and described the breach as a warning to Washington, though it claimed to have stopped short of disrupting water supplies due to an ethical code.
Handala also stated it published 5 gigabytes of data as evidence of the intrusion, and screenshots released by the group appear to show access to network management interfaces in several California cities, including Bakersfield, Chico, Salinas, and Stockton. However, these images do not independently verify the group's claims.
Separately, US federal agencies, including the FBI, CISA, NSA, EPA, Department of Energy, and US Cyber Command, issued a joint advisory warning that Iranian IRGC-linked hackers, operating as CyberAv3ngers, have been actively breaching Rockwell Automation programmable logic controllers (PLCs) at U.S. water plants, energy facilities, and government buildings since at least March 2026. The advisory noted that some victims have already experienced operational disruptions and financial losses. CyberAv3ngers, also known by other aliases and affiliated with Iran's IRGC Cyber Electronic Command, are reportedly exploiting simple vulnerabilities, such as default passwords and direct internet exposure, to gain access and manipulate systems.