Handala Claims Cal Water Hack; Dataminr Reports Chico District Impact
Summary
Handala claims it stole 5 GB from California Water Service; Dataminr says leaked data points to customer billing and RTKBase systems in Chico. Cal Water says it is investigating; operational disruption is unconfirmed.
Key points
- Handala claimed responsibility for hacking California Water Service and published 5 GB of allegedly stolen data; Cal Water said it is investigating the claims.
- Dataminr assessed that the actor likely accessed a Cal Water RTKBase instance and moved laterally to a billing system; the level of access has not been confirmed.
- Dataminr said the leaked material appears to include customer names, addresses, phone numbers, account numbers and payment histories.
- The dump reportedly included RTKBase administrative credentials and an NTRIP source password; the actor also enumerated IP addresses across seven district networks.
- Handala claimed it could disrupt water access but chose not to; OT/ICS disruption was not confirmed.
- Dataminr recommended rotating exposed credentials, taking the RTKBase instance offline for an audit, and reviewing network segmentation and billing-system access logs.
Article Details
- Victim Organization
- California Water Service (Cal Water)
- Incident Type
- Handala claimed an intrusion and published 5 gigabytes of data allegedly stolen from Cal Water; the extent of access and theft has not been confirmed.
- Data Types Exposed
- Names
- Addresses
- Phone numbers
- Account numbers
- Payment histories
- RTKBase administrative credentials
- NTRIP source password
- Affected Data Size
- 5 gigabytes allegedly stolen and published
- Operational Impact
- No OT/ICS disruption has been confirmed. Handala claimed it could disrupt water access but said it chose not to. Cal Water said it was investigating the claims.
- Claim Status
- claimed
Threat Actors
Banished KittenIdentified by the article as a name under which Handala is also tracked; the Cal Water attack was claimed by Handala, but the extent of access has not been confirmed.DuneIdentified by the article as a name under which Handala is also tracked; the Cal Water attack was claimed by Handala, but the extent of access has not been confirmed.HandalaClaimed responsibility for hacking Cal Water and published 5 gigabytes of data allegedly stolen from the utility. The extent of its access and the alleged theft have not been confirmed.Homeland JusticeIdentified by the article as a name under which Handala is also tracked; the Cal Water attack was claimed by Handala, but the extent of access has not been confirmed.Red SandstormIdentified by the article as a name under which Handala is also tracked; the Cal Water attack was claimed by Handala, but the extent of access has not been confirmed.Storm-0842Identified by the article as a name under which Handala is also tracked; the Cal Water attack was claimed by Handala, but the extent of access has not been confirmed.Void ManticoreIdentified by the article as a name under which Handala is also tracked; the Cal Water attack was claimed by Handala, but the extent of access has not been confirmed.
Malware
Hamsa Wiper“While OT/ICS disruption is not confirmed in this incident, Handala’s deployed toolkit includes custom wipers (win.handala, Handala Wiper, Hamsa Wiper) and MBR-overwriting capabilities.Handala Wiper“While OT/ICS disruption is not confirmed in this incident, Handala’s deployed toolkit includes custom wipers (win.handala, Handala Wiper, Hamsa Wiper) and MBR-overwriting capabilities.win.handala“While OT/ICS disruption is not confirmed in this incident, Handala’s deployed toolkit includes custom wipers (win.handala, Handala Wiper, Hamsa Wiper) and MBR-overwriting capabilities.
Products
Countries
IranThe Iran-linked threat actor Handala this week boasted to have hacked California Water Service (Cal Water), and published 5 gigabytes of data allegedly stolen from the US water utility.United StatesThe Iran-linked threat actor Handala this week boasted to have hacked California Water Service (Cal Water), and published 5 gigabytes of data allegedly stolen from the US water utility.