U.S. Agencies Warn of Cyberattacks Targeting Fuel Storage Systems

WASHINGTON (June 3, 2026) — The Cybersecurity and Infrastructure Security Agency, alongside the FBI, the National Security Agency, and the Department of Energy, issued a joint alert Tuesday warning of active cyberattacks targeting internet-exposed automatic tank gauge systems across the United States. The agencies stated that threat actors are exploiting multiple vulnerabilities to compromise systems used to monitor fuel and liquid storage tanks, posing potential risks to infrastructure integrity and environmental safety.

The alert details a series of technical flaws being leveraged by the attackers, including authentication bypass vulnerabilities, hardcoded credentials, command-execution flaws, SQL injection, and privilege-escalation weaknesses. By exploiting these gaps, adversaries are capable of modifying system settings, which could lead to inaccurate readings or unauthorized changes to tank operations. The agencies noted that such manipulation could increase the risk of leaks from storage facilities.

The threat actors remain unattributed in the official alert, though previous incidents involving similar tactics have been linked to Iranian hackers. The agencies did not confirm a direct connection in this specific campaign but highlighted the sophistication of the methods employed. The vulnerabilities affect a range of industrial control systems commonly found in fuel distribution networks, chemical storage sites, and other facilities managing liquid assets.

CISA emphasized that the systems in question are often connected to the internet, making them accessible to remote attackers. The agencies are urging operators to immediately review their network configurations and implement security patches where available. They recommend isolating affected systems from public networks and changing default credentials to mitigate the risk of unauthorized access.

The Department of Energy stated that the potential for physical damage or environmental harm remains a primary concern. While no widespread incidents of tank failures or leaks have been reported as a result of these attacks, the alert serves as a preventative measure to harden defenses before more significant disruptions occur. Industry experts note that many older tank gauge systems were not designed with modern cybersecurity standards in mind, leaving them particularly vulnerable to exploitation.

Federal officials are coordinating with private sector partners to identify affected systems and assist in remediation efforts. The alert does not specify the number of compromised facilities, nor does it detail the geographic scope of the attacks beyond the United States. Questions remain regarding the full extent of the threat and whether any data has already been exfiltrated or operations altered without detection.

As the investigation continues, the agencies are monitoring for additional indicators of compromise and will update the alert if new information becomes available. The situation remains fluid, with ongoing efforts to secure critical infrastructure against evolving cyber threats.