Handala hackers breach one Cal Water customer account
An Iranian-linked hacker group called Handala claimed on June 11, 2026 that it breached California Water Service systems statewide and could disrupt water supply. An investigation supported by Mandiant found the group only accessed one customer's online account using stolen credentials, plus a third-party GPS correction tool site, and never touched Cal Water's internal or operational technology systems.
- Started
- Jun 11, 2026
- Latest activity
- Jul 1, 2026
- Closed out
- Jul 1, 2026
- Attributed to
- Handala (Iran-linked)Confirmed
- Where
- United States
- Sectors
- Water
- Scale
- one California Water Service customer account
Current status
Cal Water said this week (reported July 1, 2026) that its investigation, backed by Mandiant, found no evidence of activity in internal or operational technology systems, closing out the incident.
Resolved: Services were restored and the incident was closed out.
Who is behind it
Handala publicly claimed the breach on June 11, 2026, and Cal Water confirmed the group accessed one customer account, though press reports call the group only 'Iranian-linked' rather than formally state-attributed.
Impact
Hackers used stolen credentials to log into a single customer's online Cal Water account and accessed an unrelated third-party GPS correction tool website. No billing system, payment data, or internal/operational technology systems were accessed, so water service was never at risk.
What to do
Cal Water customers who want reassurance can watch for official notices from the utility, but no broad credential reset or alert has been issued.
Timeline
-
Jul 1, 2026
Cal Water confirmed the breach was limited to one customer's online account accessed via stolen credentials, with no billing or payment data exposed.
Resolvedmercurynews.com -
Jun 25, 2026
Mandiant-supported investigation found no evidence of activity in Cal Water's internal or operational technology environments.
Containedsecurityweek.com -
Jun 11, 2026
Handala claimed it breached Cal Water systems statewide and could disrupt water supply, calling it a warning after strikes on water resources in Sirik, Iran.
Emergingmercurynews.com
Sources
- Cal Water says cybersecurity breach by Iranian-linked hackers was limited Mercury News Jul 1, 2026
- Cal Water Finds No Evidence of OT Activity After Hackers Claimed They Could Disrupt Water Supply SecurityWeek Jun 25, 2026