Loading story…
California Water Service said an investigation into intrusion claims by the Iranian-linked group Handala found no evidence of attacker activity in its internal IT or operational technology environments, despite the group’s assertion that it could disrupt the water supply. Cal Water, working with Mandiant and government partners, said the incident was limited to unauthorized access to a small number of user accounts in two third-party service provider platforms, one active customer online account accessed with stolen credentials, and a third-party GPS correction website that held no sensitive information. The company said the customer portal access did not expose payment data or provide a path into its billing system, and investigators found no indication that industrial control systems were accessed.
The case adds to scrutiny of Handala, which has been linked by researchers and officials to Iranian operations targeting critical infrastructure and private-sector organizations. Analysts reviewing files the group claimed to leak from Cal Water found personal information and signs that a customer billing system and an internal application may have been compromised, even as the utility maintained that core internal and OT systems showed no evidence of intrusion. In a separate matter, medical device maker Stryker is seeking dismissal of a class action tied to a March cyberattack also claimed by Handala, arguing there is no evidence the plaintiffs’ personal data was accessed, underscoring a broader pattern in which the group pairs disruptive claims and alleged data theft with contested evidence of actual compromise.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
Cal Water said its investigation found unauthorized access was limited to a small number of user accounts in two third-party service provider platforms, one active customer online account accessed with stolen credentials, and an external GPS correction website. The company and Mandiant said they found no evidence of threat actor activity in Cal Water's internal IT or operational technology environments.
Stryker sought dismissal of a proposed class action lawsuit brought by current and former employees, arguing its investigation found no evidence that the named plaintiffs' personally identifiable information was accessed. The lawsuit followed the company's March 2026 cyberattack and raised questions about standing where disruption is evident but plaintiff data theft is unproven.
After allegations surfaced on June 11, 2026, Cal Water activated its cybersecurity response plan and worked with Mandiant and government partners to investigate the claimed intrusion. The investigation focused on whether the Iranian-linked group Handala had accessed internal IT or operational technology systems.
In March 2026, Handala claimed responsibility for a cyberattack on Stryker, alleging it stole 50 terabytes of data and wiped 200,000 devices and 12 petabytes of Stryker data. Stryker said the incident disrupted internal electronic ordering and related client-facing systems for several weeks, but not devices and systems connected to customers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcesecuritymagazine.com
Open sourcegovinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iran-linked hacking group **Handala** claimed it breached California Water Service (**Cal Water**), a major utility serving roughly two million people across about 100 California communities, and released a **5 GB** data dump that reportedly included customer billing records, personally identifiable information, administrative credentials, and network infrastructure details tied to multiple service districts. Reporting indicates the intrusion may have begun through an internal **RTKBase GPS correction system** used by field crews, with stolen passwords potentially enabling lateral movement into the customer billing environment. Security researchers and incident reporting said the available evidence supports compromise of a GPS-related server and billing database, but does **not** confirm disruption of operational technology, industrial control systems, or water treatment operations, despite Handala's claims that it could shut off water supplies. Experts described the incident as consistent with the group's pattern of combining real intrusions and data theft with exaggerated claims, while warning that the breach underscores the need for password resets and stronger segmentation between operational, IoT, and corporate networks amid broader concerns about Iranian targeting of U.S. critical infrastructure.
Jun 29, 2026
The **FBI** seized two websites used by the pro-Iranian hacktivist group **Handala** after the group claimed responsibility for a destructive cyberattack against **Stryker**. The seized domains, including Handala’s leak and publicity sites, were replaced with a U.S. law enforcement banner stating the infrastructure was used to support malicious cyber activity conducted on behalf of, or in coordination with, a foreign state actor. Reporting indicates the domains’ nameservers were changed to FBI-controlled infrastructure, and Handala later acknowledged on Telegram that its sites had been taken offline. The takedown followed a major intrusion into Stryker’s Microsoft environment that was described as highly destructive and involved abuse of legitimate **endpoint management** capabilities to wipe large numbers of devices and exfiltrate data. Public reporting differs on the scale of the impact, with estimates ranging from roughly **80,000** to **200,000** affected systems, while CISA said the incident should be treated as a warning that cyber activity tied to Middle East conflict may spill into U.S. organizations. CISA urged defenders to harden platforms such as **Microsoft Intune** by enforcing least privilege, role-based access controls, phishing-resistant MFA, and approval workflows for sensitive actions such as device wiping.
Jun 29, 2026
U.S. medical device manufacturer **Stryker** reported a severe, global disruption to its Microsoft/Windows environment following a cyberattack that left employees unable to access corporate systems. Staff reported corporate laptops and phones being wiped, widespread outages of work applications and email, and some login pages displaying the **Handala** logo; the company also routed calls to an automated message citing a “building emergency.” Stryker said it is experiencing a “global network disruption,” believes the incident is contained, and stated it has **no indication of ransomware** while working to restore operations using business continuity measures. A pro-Iran hacktivist group calling itself **Handala** publicly claimed responsibility, framing the attack as retaliation tied to the U.S.-Iran conflict and citing a reported U.S. strike on a girls’ school in Tehran. The group alleged it wiped large numbers of systems and exfiltrated significant data, and reporting indicated at least partial corroboration of system wiping and defacement across Stryker’s global environment. The incident appears to have caused broad operational impact across Stryker’s international footprint, with claims and employee reports indicating both destructive activity (device/server wiping) and potential data theft, though Stryker’s public statement did not confirm exfiltration.
Aug 17, 2026