SACRAMENTO, CALIF. — An Iran-linked hacking group known as Handala has claimed responsibility for breaching California Water Service (Cal Water), one of the largest water utilities in the United States serving approximately 2 million customers securityaffairs.com . Imagine a foreign adversary gaining access to the systems that control the water flowing to millions of homes—this incident brings the threat to critical infrastructure into sharp focus.

The group accessed billing data and customer information through an exposed GPS tool, eventually leaking about 5GB of data securityaffairs.com . While Cal Water and security experts emphasize that the water delivery systems themselves were not disrupted, the breach demonstrates how easily IT systems can serve as a foothold for potential OT (operational technology) attacks.

Experts note that Handala has a history of overstating its capabilities, but the fact that a state-sponsored group targeted a U.S. water utility signals escalating tensions and the growing boldness of cyber actors targeting critical infrastructure securityaffairs.com .

CISA and the FBI are investigating the incident. Cal Water has notified affected customers and is working with cybersecurity firms to strengthen defenses. The breach serves as a stark reminder that critical infrastructure remains a prime target for nation-state actors, and the line between IT and OT systems is often thinner than utilities realize.