Cal Water Investigation Finds No Evidence of Attacker Activity in OT Systems

Summary

Cal Water says Mandiant found no attacker activity in its internal IT or OT environments. The investigation found access to limited third-party accounts, including one customer account accessed with stolen credentials; analysts had reported possible compromise of other

Key points

Cal Water says Mandiant found no evidence of threat-actor activity in the utility’s internal IT or operational technology environments.
Mandiant found unauthorized access limited to a small number of user accounts on two third-party service platforms.
The investigation found that one active customer’s online account was accessed using stolen credentials; Cal Water says it did not provide billing-system access and no payment information was compromised.
The actor claimed access that could have disrupted water supply and leaked 5 GB allegedly taken from Cal Water systems.
Analysts found personal information in the leaked files and evidence that a customer billing system and an internal application may have been compromised; Cal Water’s investigation reported no evidence of activity in its internal environments.

Article Details

Victim Organization: California Water Service (Cal Water)
Incident Type: Unauthorized access to a small number of user accounts on third-party service provider platforms; one active customer’s online account was accessed using stolen credentials. Handala also claimed access to Cal Water systems.
Data Types Exposed: Personal information was found in files published by the threat actor; the source does not confirm that this information was taken from Cal Water systems.
No payment information was compromised.
Affected Records: Not disclosed
Affected Data Size: Handala leaked 5 GB of data allegedly taken from Cal Water systems; the claim was not confirmed by the investigation.
Operational Impact: Cal Water and Mandiant found no evidence of threat actor activity in Cal Water’s internal IT or OT environments. No water-supply disruption was reported. The investigation confirmed access to one active customer’s online account, which did not provide access to the billing system.
Ransom Or Extortion: None reported
Claim Status: confirmed

Threat Actors

HandalaClaimed responsibility for accessing Cal Water systems and said it could have disrupted the water supply. Cal Water’s investigation confirmed limited unauthorized access to third-party service provider platforms and one customer account, but found no evidence of activity in its internal IT or OT environments. The article says Handala claims to be a hacktivist collective and is widely believed to be a front for Iranian government hacking operations.

Vendors

MandiantCal Water, one of the largest investor-owned water utilities in the United States, has hired cybersecurity experts, including Google’s Mandiant unit, to assist with the investigation into the cybersecurity incident.

Industries

Water utilitiesCal Water, one of the largest investor-owned water utilities in the United States, has hired cybersecurity experts, including Google’s Mandiant unit, to assist with the investigation into the cybersecurity incident.