U.S. Agencies Warn of Attacks on 900+ Exposed Tank-Gauge Systems
Summary
U.S. agencies warn that attackers are compromising internet-exposed automatic tank gauge systems through flaws including hardcoded credentials and command-execution weaknesses. Shadowserver observed 1,061 exposed devices, 909 in the U.S.; agencies urge restricting and —
Key points
- A joint U.S. government advisory says threat actors have compromised internet-exposed automatic tank gauge (ATG) systems and modified them through command execution. The agencies have not attributed this activity to a nation-state or group.
- The advisory lists hardcoded credentials, authentication bypasses, SQL injection, OS command execution flaws, and privilege escalation weaknesses among the issues used to gain access.
- Shadowserver reported seeing 1,061 exposed ATG IPs on June 5, 2026, including 909 in the United States, after filtering out many systems it believed were honeypots.
- Attackers may change settings or disable alerts, increasing the risk of leaks or equipment failures and potentially causing permanent tank-system damage.
- Agencies advise restricting internet access and using controlled remote access, replacing default passwords, applying security updates, monitoring for unauthorized changes, and enabling MFA where possible.
- A May CNN report said Iranian hackers breached ATG systems at multiple U.S. gas stations. The attackers reportedly changed display readings but not actual fuel levels; the reported incidents caused no physical damage, and the Iranian attribution was based on groups’ prior targeting history.
Article Details
- Event Type
- U.S. government joint advisory warning of ongoing attacks against internet-exposed automatic tank gauge (ATG) systems.
- Impact
- More than 900 ATG systems in the United States were reported exposed online; Shadowserver separately reported 1,061 exposed systems globally, including 909 in the United States, as of 2026-06-05. Successful compromises can allow attackers to change settings or disable alerts, potentially hindering leak detection and contributing to equipment failure or tank damage. A CNN report said attackers manipulated display readings at multiple gas stations but did not change actual fuel levels, and those incidents caused no physical damage. The advisory states that the U.S. government has not attributed the recent activity to a nation-state or threat actor group; separate reporting linked some incidents to Iranian hackers.
MITRE ATT&CK
Products
Countries
Industries
chemical storageOver 900 automatic tank gauge (ATG) systems in the United States are exposed online and vulnerable to attacks that can alter settings, disable alerts, and disrupt fuel or chemical storage monitoring.gas stationsWhile they’re commonly used at gas stations to monitor fuel tank levels, they can also be found in industrial settings to track chemical storage tanks.