An article from

California Water Service said it is investigating claims by an Iran-linked threat group of a cyberattack against the water utility. 

The Iran-nexus group tracked as Handala claimed an attack against the water utility and cautioned that it deliberately avoided any attempt to disrupt the facility’s water distribution, according to Check Point Research. 

Cal Water, the largest water utility in the western U.S., confirmed that a claim was made on June 11. It said it is continuing to investigate. 

“We take cybersecurity and this claim very seriously and are working around the clock to investigate,” a spokesperson told Cybersecurity Dive via email.

After learning of the claim last Thursday, Cal Water officials have been working with forensic investigators as well as federal and state law enforcement. Preliminary results show no operational disruptions to water systems or customer billing, the spokesperson said. 

The group Handala claims the attack was retaliation for recent U.S. military operations in Sirik, Iran, according to Check Point Research. The group also claims it deliberately chose not to disrupt water services at the utility. 

The group posted several screenshots that appear to show customer relationship management and billing systems, global navigation satellite systems, access to customer information and several internal credentials.

Check Point Research said if the posted information is confirmed, it would indicate the hackers gained access to the utility’s information technology systems and not the operational technology systems that could control water distribution.  

The disclosure came just days after a Utah-based water utility said it had recovered from a March attack on its facilities. Sage Energy Partners last week said it had remediated systems at its Sage Water Resources facility, which operates a salt-water disposal facility in Duchesne, Utah. 

The company said an investigation found that a sophisticated nation-state threat actor compromised the programmable logic controllers automation system at the facility. Sage officials said the attack was consistent with a wider campaign targeting critical infrastructure across the U.S.

As previously reported, the Cybersecurity and Infrastructure Security Agency and the FBI previously issued an advisory warning of a threat to water and energy facilities by state-linked hackers. The agencies confirmed that multiple sites had been attacked, leading to disruption and financial impacts. 

Handala is considered one of the most notorious threat actors linked to Iran. The group claimed credit for a March attack against medical device maker Stryker.

Federal officials seized domains linked to Handala after the group used various websites to publicize attacks and target political dissidents.