Itron detected unauthorized access to part of its IT environment on April 13, 2026, and launched incident response and notified authorities.

Itron disclosed a cyber incident involving unauthorized access to part of its internal IT systems, detected on April 13, 2026. The company activated its incident response plan, engaged external cybersecurity experts, and notified law enforcement to investigate and contain the intrusion. The company reported that no unauthorized activity was seen in the customer-hosted portion of its systems, which is an important detail because Itron works with utility infrastructure and critical operational environments.

“On April 13, 2026, Itron, Inc. (the “Company” or “Itron”) was notified that an unauthorized third party had gained access to certain of its systems.

The Company activated its cybersecurity response plan and launched an investigation with the support of external advisors to assess, mitigate, remediate, and contain the unauthorized activity. The Company’s response efforts included proactively notifying law enforcement.” reads the FORM 8-K report filed with SEC.

“The Company took action to remediate and remove the unauthorized activity and has not observed any subsequent unauthorized activity within its corporate systems. Further, no unauthorized activity was observed in the customer hosted portion of its systems.”

At this time, no ransomware group has claimed responsibility for the attack.

Itron is a U.S.-based firm that develops smart solutions for energy, water, and smart city infrastructure. It employs about 4,987 people and reported roughly $2.37 billion in annual revenue in 2025, providing utilities with data analytics, smart meters, and grid management technologies.

Itron said operations continue largely unaffected thanks to contingency plans and backups, and expects insurance to cover much of the incident’s cost. However, the utility giant is still investigating the security breach to determine the exact scope of the attack.

“The Company is evaluating what legal filings and regulatory notifications might be required because of this incident and intends to take appropriate action based on its review and findings.” continues the report. “While the Company’s investigation and assessment of this incident is ongoing, the Company does not currently believe the incident has had or is reasonably likely to have a material impact on the Company.”

It is important to highlight that Itron is not a generic software vendor. It provides utility technology products and services for energy and water management, and its systems are tied to critical infrastructure.

For firms tied to critical services, being able to keep systems running during an investigation is often just as important as removing the attacker.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, security breach)

---

---