No zero-day exploit. No sophisticated supply chain attack. No nation-state budget required.

Suspected Iranian hackers breached fuel monitoring systems at gas stations across multiple US states by exploiting automatic tank gauges that were sitting on the internet without passwords, according to multiple sources briefed on the activity. CNN first reported the intrusions on Thursday. The systems — which measure fuel levels in storage tanks — were essentially left with the front door open.

The intrusions have not caused known physical damage. Hackers were able in some cases to alter display readings on the tanks, though not the actual fuel levels. But the breach has alarmed officials and private experts because, in theory, access to an automatic tank gauge could allow an attacker to mask a gas leak — turning a digital intrusion into a physical safety hazard.

A Decade of Warnings, Ignored

This was not an unpredictable event. Cybersecurity researchers have been sounding alarms about internet-facing automatic tank gauges for more than ten years. In 2015, security firm Trend Micro deployed mock ATG systems online to see who would target them. A pro-Iran hacking group surfaced quickly. In 2021, Sky News cited internal Islamic Revolutionary Guard Corps documents that explicitly identified ATGs as targets for disruptive cyberattacks on gas stations.

The warnings kept coming. Bitsight TRACE researchers and the Cybersecurity and Infrastructure Security Agency (CISA) disclosed 10 critical vulnerabilities across five ATG vendors in September 2024. One vulnerability — in the ProGauge MagLink tank console — carried the maximum severity rating of 10.0. Pedro Umbelino, the Bitsight security scientist who discovered the flaws, found hundreds of these systems exposed online using basic research methods. During a three-month disclosure window, only a handful were taken offline.

Of the five affected vendors — Omntec, Alisonic, OPW, ProGauge, and Franklin Fueling Systems — two did not respond to CISA’s outreach at all, according to CyberScoop. The US is, by Bitsight’s assessment, “the most affected country by far.”

The Broader Campaign

The gas station breaches are one thread in a wider Iranian cyber campaign that has accelerated since the US-Israeli war with Iran began in late February. Tehran-linked hackers have disrupted operations at US oil and gas facilities, water utilities, and medical device manufacturer Stryker, where manipulation of the company’s Microsoft Intune environment caused brief manufacturing and shipping delays in March, according to a joint advisory from the FBI and CISA.

Iranian actors are “under pressure and are trying to strike wherever they find an opening in cyberspace,” Yossi Karadi, head of Israel’s National Cyber Directorate, told CNN.

The FBI and CISA advisory, released Tuesday, warned that Iran-linked actors have exploited internet-facing programmable logic controllers made by Rockwell Automation and Allen-Bradley. More than 3,000 Rockwell devices remain visible on the public internet, according to Markus Mueller, field CISO at Nozomi Networks — either because organizations don’t know they’re exposed or underestimate the risk.

Iran’s cyber capabilities have long been considered inferior to those of China or Russia. But the wartime campaign suggests Tehran is more capable and opportunistic than its reputation allows. Allison Wikoff, a director on PwC’s threat intelligence team, described a shift toward “faster iteration, more layered hacktivist personas, and likely AI-driven scaling for reconnaissance and phishing.”

Soft Targets, Hard Questions

US officials suspect Iran’s involvement in the ATG breaches based on the country’s documented history of targeting those specific systems. But they caution that a lack of forensic evidence may prevent definitive attribution.

The systemic failure is not a mystery. Thousands of industrial control systems — fuel monitors, water pressure gauges, programmable controllers — sit connected to the internet with minimal protection. Patching them is difficult: the equipment runs continuously, often sits in remote locations, and was typically installed by operators with no cybersecurity expertise. Vendors have been slow to respond, and in some cases haven’t responded at all.

The EPA, Department of Energy, NSA, and US Cyber Command all participated in this week’s joint advisory, urging operators to enable multifactor authentication, remove devices from the public internet, and check logs for suspicious activity. That such basic hygiene instructions constitute urgent federal guidance in 2026 tells you everything about the state of US infrastructure security.

The gas station hacks didn’t require sophistication. That’s what makes them worrying.

Sources