Loading story…
Iran-linked hacking group Handala claimed it breached California Water Service (Cal Water), a major utility serving roughly two million people across about 100 California communities, and released a 5 GB data dump that reportedly included customer billing records, personally identifiable information, administrative credentials, and network infrastructure details tied to multiple service districts. Reporting indicates the intrusion may have begun through an internal RTKBase GPS correction system used by field crews, with stolen passwords potentially enabling lateral movement into the customer billing environment.
Security researchers and incident reporting said the available evidence supports compromise of a GPS-related server and billing database, but does not confirm disruption of operational technology, industrial control systems, or water treatment operations, despite Handala's claims that it could shut off water supplies. Experts described the incident as consistent with the group's pattern of combining real intrusions and data theft with exaggerated claims, while warning that the breach underscores the need for password resets and stronger segmentation between operational, IoT, and corporate networks amid broader concerns about Iranian targeting of U.S. critical infrastructure.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
After learning of Handala's breach claim last Thursday, California Water Service activated its cybersecurity response plan and began working with state and federal partners and external experts. The utility said preliminary findings showed no known operational disruptions to its water, wastewater, or billing systems.
SC Media said the Cal Water incident followed Handala's wiper attack on Stryker in March 2026, identifying an earlier campaign activity by the same Iran-linked group.
On 2026-06-11, Handala claimed it had breached California Water Service and released about five gigabytes of data. Reported material included customer billing information, administrative credentials, and network-related information tied to multiple service districts and an internal GPS correction environment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
5 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcesecuritymagazine.com
Open sourcehackread.com
Open sourcescworld.com
Open sourcedataminr.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
California Water Service said an investigation into intrusion claims by the Iranian-linked group **Handala** found no evidence of attacker activity in its internal IT or operational technology environments, despite the group’s assertion that it could disrupt the water supply. Cal Water, working with **Mandiant** and government partners, said the incident was limited to unauthorized access to a small number of user accounts in two third-party service provider platforms, one active customer online account accessed with stolen credentials, and a third-party GPS correction website that held no sensitive information. The company said the customer portal access did not expose payment data or provide a path into its billing system, and investigators found no indication that industrial control systems were accessed. The case adds to scrutiny of **Handala**, which has been linked by researchers and officials to Iranian operations targeting critical infrastructure and private-sector organizations. Analysts reviewing files the group claimed to leak from Cal Water found personal information and signs that a customer billing system and an internal application may have been compromised, even as the utility maintained that core internal and OT systems showed no evidence of intrusion. In a separate matter, medical device maker **Stryker** is seeking dismissal of a class action tied to a March cyberattack also claimed by Handala, arguing there is no evidence the plaintiffs’ personal data was accessed, underscoring a broader pattern in which the group pairs disruptive claims and alleged data theft with contested evidence of actual compromise.
Jun 29, 2026
Researchers linked **Handala Hack** to Iran’s Ministry of Intelligence and Security as part of the broader **Void Manticore** cluster, describing a coordinated campaign that targeted organizations in Israel, Albania, and the United States with disruptive and destructive intrusions. Reported victims and incidents included attacks on **Stryker**, compromises affecting kindergarten emergency alert systems, and a personal Gmail breach publicly attributed to FBI Director Kash Patel that the FBI said involved historical, non-classified data. U.S. authorities also seized four domains allegedly used by the operation to leak stolen data, publicize attacks, and support influence activity. Investigators said the intrusions commonly began with **compromised VPN credentials**, followed by hands-on-keyboard movement over **RDP**, use of **NetBird** for tunneling, credential theft, Active Directory reconnaissance, and staged malware delivery. The destructive phase combined multiple methods at once, including a custom **Handala Wiper**, **PowerShell-based wiping**, **VeraCrypt** encryption, manual deletion of files and virtual machines, and tooling tied to webshell persistence, Telegram-linked data exfiltration, driver-assisted disk access, and attempts to disable endpoint defenses. Analysts also tied Handala to other MOIS personas including **Homeland Justice** and **Karma**, saying the fronts shared infrastructure, domain patterns, Telegram-based communications, and overlapping tradecraft in a single coordinated state-backed campaign.
Jun 29, 2026
The Iranian-linked **Handala** group claimed it had disrupted Israeli radar systems and placed the Kfar Yona municipality under a “cyber siege” amid renewed Iran-Israel hostilities. Reporting on the incident found that the evidence released by the group does **not** substantiate a radar intrusion: the screenshots and access shown appear to match a **Tadiran Telecom Aeonix** IVR/VoIP administration panel, suggesting compromise of a municipal or organizational phone system rather than military radar infrastructure. Researchers said the operation fits a broader pattern in which cyber activity is used to amplify battlefield messaging during escalating regional conflict involving Hezbollah fire, Israeli strikes in Beirut, IRGC missile launches, and Israeli retaliatory strikes on Tehran, Tabriz, and Isfahan. While the specific radar-disruption claim bears the hallmarks of propaganda and remains uncorroborated by independent evidence or official acknowledgment, Handala is described as a real state-affiliated threat actor with documented capabilities including credential theft, abuse of legitimate enterprise tools, wiper malware, and hack-and-leak operations, raising the likelihood of further disruptive attacks and inflated claims.
Jun 29, 2026