{"id":798972,"date":"2026-05-15T20:32:19","date_gmt":"2026-05-15T20:32:19","guid":{"rendered":"https:\/\/www.europesays.com\/us\/798972\/"},"modified":"2026-05-15T20:32:19","modified_gmt":"2026-05-15T20:32:19","slug":"iran-hackers-hackers-have-breached-tank-readers-at-gas-stations-officials-suspect-iran-is-responsible","status":"publish","type":"post","link":"https:\/\/www.europesays.com\/us\/798972\/","title":{"rendered":"Iran hackers: Hackers have breached tank readers at gas stations; officials suspect Iran is responsible"},"content":{"rendered":"

\n US officials suspect <\/strong>Iranian<\/a> hackers are behind a series of breaches <\/strong>of systems that monitor the amount of fuel in storage tanks serving gas stations in multiple states, according to multiple sources briefed on the activity.\n <\/p>\n

\n The hackers responsible have exploited automatic tank gauge (ATG) systems that were sitting online and unprotected by passwords, allowing them in some cases to tinker with display readings on the tanks but not the actual levels of fuel in them, the sources said.\n <\/p>\n

\n The cyber intrusions are not known to have caused physical damage or harm, but the breaches have raised safety concerns because gaining access to an ATG could, in theory, allow a hacker to make a gas leak go undetected, according to private experts and US officials.\n <\/p>\n

\n The sources briefed on the investigation said Iran\u2019s history of targeting the gas tank systems is one reason the country is a top suspect. But, the sources cautioned, the US government may not be able to definitively determine who was responsible because of a lack of forensic evidence left by the hackers.\n <\/p>\n

\n CNN has requested comment on the ATG hack from the US Cybersecurity and Infrastructure Security Agency. The FBI declined to comment.\n <\/p>\n

\n If Iran\u2019s involvement is confirmed, it would be the latest case of Tehran threatening critical infrastructure in the US homeland, which remains out of reach of Iranian drones and missiles, amid the US and Israeli war with Iran.\n <\/p>\n

\n It could also raise a politically sensitive issue for the Trump administration by drawing further attention to higher gas prices caused by the war. Seventy-five percent of US adults surveyed in a recent CNN poll<\/a> said the Iran war had a negative effect on their finances.\n <\/p>\n

\n The hacking campaign is also a warning to many US critical infrastructure operators who have struggled to secure their systems despite years of federal exhortations.\n <\/p>\n

\n Iranian hacking groups have long looked for low-hanging fruit \u2014 critical US computer systems sitting online that interact with oil and gas sites and water systems, for example. After Hamas attacked Israel on October 7, 2023, US officials blamed hackers affiliated with Iran\u2019s Islamic Revolutionary Guard Corps for a series of attacks<\/a> on US water utilities that displayed an anti-Israel message on equipment used to manage water pressure.\n <\/p>\n

\n Cybersecurity researchers have been warning about internet-facing ATGs for over a decade. In 2015, security firm Trend Micro put mock ATG systems online<\/a> to see what kind of hackers would target them. A pro-Iran group was quick to surface.\n <\/p>\n

\n A 2021 report<\/a> from Sky News cited internal documents from the Islamic Revolutionary Guard Corps that singled out ATGs as a potential target for a disruptive cyberattack on gas stations.\n <\/p>\n

\n US intelligence agencies have long considered Iran\u2019s cyber capabilities inferior to those of China or Russia. But a string of opportunistic hacks of key US assets during the war suggests Iran is a capable \u2014 and unpredictable \u2014 adversary.\n <\/p>\n

\n Since the war began in late February, Tehran-linked hackers have caused disruptions<\/a> at multiple US oil and gas and water sites, shipping delays<\/a> at Stryker, a major US medical device maker, and have leaked<\/a> the private emails of FBI Director Kash Patel.\n <\/p>\n

\n Israeli organizations and citizens have also been heavily targeted by Tehran\u2019s hackers during the latest war, while the US and Israeli military have used cyber operations to make their kinetic strikes more lethal<\/a>.\n <\/p>\n

\n Iran\u2019s cyber activity during the war has shown \u201ca significant increase in the scale, speed, and integration between cyber operations and psychological campaigns,\u201d Yossi Karadi, head of the Israel\u2019s cyber defense agency, the National Cyber Directorate, told CNN.\n <\/p>\n

\n The Israel Defense Forces in March claimed to have struck a compound housing Iran\u2019s \u201cCyber Warfare headquarters.\u201d It\u2019s unclear how many Iranian cyber operatives, if any, were killed in that strike.\n <\/p>\n

\n Karadi would not comment on that matter, citing his agency\u2019s mandate, which is limited to cyber defense.\n <\/p>\n

\n \u201cThat said, from a defensive perspective, in recent month, we are seeing some degradation in parts of the hostile cyber activity,\u201d he said. \u201cThe bottom line is that Iranian actors are under pressure and are trying to strike wherever they find an opening in cyberspace.\n <\/p>\n

\n The last 18 months have shown that Iran\u2019s cyber operations in general \u201care now accelerating with faster iteration, more layered hacktivist personas, and likely AI-driven scaling for reconnaissance and phishing,\u201d said Allison Wikoff, a director on PwC\u2019s threat intelligence team with over a decade of experience tracking Iran-based threats.\n <\/p>\n

\n \u201cWhat\u2019s notably new in their cyber playbook is the swift creation of \u2018good-enough\u2019 malware, including the destructive wiping types, complemented by assertive hack-and-leak campaigns against media, dissidents, and \ufeffkey (US) <\/strong>civilian infrastructure,\u201d Wikoff told CNN.\n <\/p>\n

\n Part of that Iranian playbook is capitalizing on the wartime footing of an American media quick to pounce on claims made by all sides.\n <\/p>\n

\n Hackers associated with Iran\u2019s intelligence ministry and paramilitary arm maintain a number of \u201chacktivist\u201d personas through which they use Telegram to exaggerate their exploits, publish stolen material and release promotional videos spliced to catchy music.\n <\/p>\n

\n One of the groups, calling itself Handala after a Palestinian cartoon character, taunted Patel while <\/strong>claiming it had breached the FBI\u2019s \u201cimpenetrable\u201d computer systems. In reality, the hackers got into Patel\u2019s years-old Gmail emails.\n <\/p>\n

\n \u201cThe fact that every Handala claim leads to people freaking out demonstrates that the operational reality of the threat Iran poses is something that both government agencies and vendors don\u2019t seem to be able to articulate,\u201d said Alex Orleans, a cybersecurity researcher who has tracked Iran-linked hackers for years and leads threat intelligence at security firm Sublime Security.\n <\/p>\n

\n Despite the string of hacks from Iran during the war, Orleans offered two reasons there haven\u2019t been more.\n <\/p>\n

\n \u201cThe first is that Iran appears to have lacked the lines of access to deliver sustained effects, or we likely would\u2019ve seen more incidents like Stryker,\u201d he told CNN. \u201cThe second is that the regime has clearly demonstrated its intention to endure, which further disincentivizes wanton cyber effects operations.\u201d\n <\/p>\n

\u2018Nobody\u2019s paying a price for it\u2019<\/p>\n

\n For some current and former US officials, the aggressive and unpredictable nature of Iranian cyber operations take on added significance ahead of the midterm elections.\n <\/p>\n

\n In the 2020 election, federal agencies, including the Cybersecurity and Infrastructure Security Agency (CISA), blamed Iran for a scheme that impersonated the far-right Proud Boys to try to intimidate voters. During the 2024 US presidential election, Iranian hackers breached the Trump campaign and sent internal documents from it to news organizations.\n <\/p>\n

\n Now, for the first election cycle in years, US military and intelligence officials have yet to activate a specialized team dedicated to detecting and thwarting foreign threats to elections \u2014 a move that one former Cyber Command official, Jason Kikta, deemed<\/a> \u201cstrategic malpractice.\u201d\n <\/p>\n

\n \u201cBetween what we\u2019ve watched Iran do in this war and what they ran in 2020, I\u2019d be surprised if they sat the midterms out,\u201d said Chris Krebs, who as CISA director in 2020 stood beside then-Director of National Intelligence John Ratcliffe as they warned the American public about Iranian and Russian influence operations.\n <\/p>\n

\n \u201cMy bet is on information operations, not attacks on election systems,\u201d Krebs told CNN. \u201cThat\u2019s where the Russians and Chinese have gone, and for good reason. It\u2019s cheap, it\u2019s easy to scale with AI, and nobody\u2019s paying a price for it.\u201d\n <\/p>\n","protected":false},"excerpt":{"rendered":"US officials suspect Iranian hackers are behind a series of breaches of systems that monitor the amount of…\n","protected":false},"author":3,"featured_media":798973,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[64,67,132,68],"class_list":{"0":"post-798972","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-business","8":"tag-business","9":"tag-united-states","10":"tag-unitedstates","11":"tag-us"},"share_on_mastodon":{"url":"https:\/\/pubeurope.com\/@us\/116580499299282617","error":""},"_links":{"self":[{"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/posts\/798972","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/comments?post=798972"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/posts\/798972\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/media\/798973"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/media?parent=798972"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/categories?post=798972"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/tags?post=798972"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}