Loading story…
Suspected Iranian hackers breached internet-exposed automatic tank gauge (ATG) systems at gas stations in several U.S. states, reportedly targeting Veeder-Root TLS-350 and TLS-450 Plus consoles that lacked password protection rather than exploiting a newly disclosed flaw. Advisories said incidents affected sites in Tennessee, including one convenience store chain with 15 tanks impacted, and in some cases attackers deleted fuel tank and sensor data or altered system settings. Officials said no physical damage was reported, but security experts warned that compromised ATGs could enable fuel overfills, disable safety alarms, and cause environmental or equipment damage.
The intrusions come amid a broader surge in attacks on operational technology across industrial sectors. NCC Group said industrial organizations suffered 2,073 ransomware attacks in the 12 months to March 2026, accounting for 30% of all ransomware activity, with manufacturers of capital goods, machinery, construction, and engineering among the hardest hit. The report said many organizations still prioritize IT defenses over OT security even as governments and regulators expand resilience requirements, while international authorities have issued procurement guidance to push stronger security controls into OT products and supply chains.
Map this exposure pattern across your cloud, code, and identities.
8 events from the most recent confirmed update back to the earliest known activity.
Shadowserver reported seeing 1,061 internet-exposed automatic tank gauge IPs on 2026-06-05 after filtering out many apparent honeypots, including 909 in the United States. The figures provided an updated snapshot of the attack surface amid ongoing federal warnings about ATG targeting.
CISA and multiple U.S. government partners published a joint fact sheet urging stronger security for automatic tank gauge systems targeted by cyber threat actors in the United States. The guidance recommended measures including removing ATG systems from the internet, using strong passwords, and auditing and monitoring logs.
Following the gas station tank gauge compromises, response efforts involved the Department of Energy's CESER team and CISA. Officials and industry groups warned that compromised ATGs could create overfill, alarm failure, environmental, and equipment damage risks even though no physical damage was reported.
Suspected Iranian hackers breached automatic tank gauge systems at gas stations in several U.S. states by accessing internet-exposed Veeder-Root consoles that lacked password protection. In Tennessee, attacks affected at least one convenience store chain with 15 tanks impacted, and some systems had fuel tank and sensor data deleted or settings changed.
Censys reported that 6,502 Automatic Tank Gauge services on 6,057 hosts across more than 65 countries were publicly reachable in May 2026, with all indexed services accessible without authentication because the protocol lacked login controls. The firm said 3,907 services exposed full unauthenticated inventory responses containing station identity and live tank data, with the United States accounting for about 70% of exposed hosts.
NCC Group reported that industrial organizations experienced 2,073 ransomware attacks in the 12 months ending in March 2026, accounting for 30% of all ransomware activity. Manufacturers of capital goods, especially machinery, construction, and engineering firms, were identified as the hardest-hit segments.
International authorities including the UK NCSC and partners from the US, Australia, Canada, and Europe issued procurement guidance to help operational technology owners embed security requirements into products and systems. The guidance reflected growing regulatory focus on OT resilience and supply-chain security.
CISA and the FBI warned that Iran-linked cyber actors were targeting critical infrastructure organizations, highlighting ongoing risks to internet-exposed operational technology and other poorly secured systems. The alert provided an earlier official warning context for later concerns about Iranian activity affecting exposed industrial environments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
19 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcebleepingcomputer.com
Open sourcedarkreading.com
Open sourcescworld.com
Open sourceenergymarketersofamerica.org
Open sourceattack.mitre.org
Open sourcenextgov.com
Open sourceic3.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Government and industry reporting warns that operational technology and industrial control systems remain dangerously exposed through weak remote access, poor segmentation, and internet-facing devices, giving both state-backed and criminal actors paths into critical infrastructure. A joint **CISA/NSA** advisory said adversaries routinely exploit legacy OT environments, public system information, and insecure remote connections to move from reconnaissance to manipulation of physical processes, while a separate **CISA/FBI** alert tied Chinese state-sponsored intrusions to U.S. natural gas pipeline operators and said the actors stole SCADA and ICS information to build capabilities for future disruption. Recent exposure research also found **6,300** internet-reachable industrial-control and building-automation devices near U.S. data centers, including **BACnet**, **Fox/Niagara**, **Modbus**, and Vertiv/Liebert systems that could affect cooling and power operations. The threat has already translated into real-world disruptive activity and increasingly specialized tooling. Dragos reported **FrostyGoop**, a Golang-based ICS malware that communicates over **Modbus TCP** and was likely used to disrupt heating services in Lviv, Ukraine, after attackers apparently entered through an internet-facing router and traversed poorly segmented networks. Other cited incidents and assessments include Israel’s thwarted attempt against water facilities, persistent Russian probing of U.S. power infrastructure, and leaked-document analysis describing a Russian capability designed to attack rail and petrochemical control systems through telecommunications access. Across the reporting, the common defensive priorities were to eliminate direct public exposure, harden and inventory remote access, enforce MFA, replace default credentials, patch supported systems, restrict engineering tools, and closely monitor OT network and protocol activity.
Aug 15, 2026
Internet-exposed Automatic Tank Gauge (ATG) systems in the United States fell sharply after industry and government warnings about active attacks against unprotected fuel monitoring consoles. BitSight reported that U.S. exposure on the ATG protocol dropped about **56%** from its March 2026 peak to June, while global exposure declined **49%**, with most of the reduction concentrated in the U.S. The decline followed alerts from the Energy Marketers of America, the Tennessee Fuel & Convenience Store Association, DOE CESER, and **CISA**, which urged operators to harden ATG deployments. BitSight said the reduction appears to reflect real remediation rather than scanning anomalies, citing churn analysis, port-hopping checks, and comparison against control traffic on port `8001`. A second dataset tracking confirmed vulnerable web-facing ATGs showed a smaller but similar decline beginning in April, although some devices resurfaced in June. Officials and researchers warned that significant risk remains because many ATGs are still reachable over `10001`, `8001`, or web interfaces, and moving systems behind VPNs, NAT, or firewalls may reduce visibility without fixing the underlying vulnerabilities or potential physical-world impact.
Aug 7, 2026
Reporting highlighted growing concern that **state-affiliated and state-linked actors** are positioning for disruptive attacks against **operational technology (OT)** and critical infrastructure, with activity that may be difficult for operators to detect. A Codific analysis described five common pathways seen in disruptive grid-focused intrusions—often beginning with **human error or exposed perimeter services**, then escalating through **credential theft**, **remote access exploitation** (e.g., VPNs/gateways), **ransomware**, and misuse of **legitimate industrial commands** that can delay operations and complicate detection and recovery; it also warned that attacks on virtualized environments can hinder restoration efforts and that cascading impacts could be severe (e.g., Lloyd’s “Business Blackout” scenario estimating losses up to **$1T**). Recommended mitigations emphasized proven controls such as **phishing-resistant MFA** and **IT/OT segmentation**, rather than novel defenses. Separate commentary and media content also pointed to OT becoming a frontline in geopolitical escalation, including claims of a coordinated campaign tied to Iran-linked hacktivist activity targeting OT devices such as **Unitronics PLCs** used in water and industrial facilities, alongside psychological operations and SMS spoofing. Other items in the set were leadership/career/podcast-style content without specific incident or vulnerability detail and do not materially add to the OT/power-grid threat reporting.
Jun 29, 2026