Iranian Cyber Group Handala Claims Hack of California Water Service in Retaliatory Attack

SAN FRANCISCO — An Iranian cyber group identified as Handala claimed responsibility on Thursday for a data breach targeting the California Water Service, releasing stolen information online and citing recent U.S. actions against Iran as motivation.

The attack was disclosed following the publication of sensitive documents attributed to the utility company's internal systems. The group stated in an online post that it had infiltrated networks belonging to the San Francisco-based water provider, which serves residential and commercial customers across several counties in Northern California.

Handala described the operation as a retaliatory measure against American policies affecting Iran. No specific details were provided regarding the nature of recent U.S. actions referenced by the group or how they directly relate to this cyber incident.

California Water Service confirmed that it is investigating an unauthorized access event involving its digital infrastructure. The company stated in a brief statement issued late Thursday afternoon that customer data may have been compromised, though no immediate impact on water delivery systems was reported. Emergency services were not activated at the time of disclosure.

Federal authorities are aware of the situation and coordinating with state agencies to assess potential risks posed by the breach. Officials from the Cybersecurity and Infrastructure Security Agency (CISA) said they are working closely with private sector partners to contain any further spread of sensitive information.

The utility company has advised affected customers to monitor their accounts for unusual activity while forensic teams work to determine the full scope of the intrusion. No ransom demands were made public by Handala, nor did the group indicate intentions beyond data exfiltration and publication.

Cybersecurity experts noted that water utilities have become increasingly frequent targets in recent years due to their critical infrastructure status. Previous incidents involving similar actors often involved attempts at disruption rather than simple theft of information. Whether this attack represents a shift toward more aggressive tactics remains unclear.

Questions remain about the extent of data accessed during the breach and whether any operational controls were tampered with beyond what was publicly disclosed. California Water Service has not yet released specifics on which types of records were obtained or how many individuals may be affected by the incident.

As investigations continue, officials urge stakeholders to maintain vigilance against potential follow-up activities from affiliated groups seeking further leverage.