Iranian hackers are suspected of cyber breaching systems that monitor fuel storage tanks at gas stations across multiple US states, CNN reported, citing American officials.
The attackers reportedly compromised automatic tank gauge (ATG) systems that were connected to the internet without password protection. While hackers were able to manipulate the numbers displayed on some screens, officials said they could not alter the actual fuel levels inside the tanks.
A cyberattack could hide a major gas leak
Security experts and US officials warned that if a hacker gains control of these tracking systems, they could theoretically hide a real gas leak. This would also be impossible to detect.
“Gas stations, tank readers, water systems, and industrial controllers may not sound high-profile, but they give attackers a way to turn a technical breach into public confusion and operational stress,” Nick Tausek, lead security automation architect at Swimlane, told Security magazine.
He added that the common weakness in many of these attacks is “exposed operational technology and weak remote access.”
Ross Filipek, chief information security officer at Corsica Technologies, said fuel systems have become attractive cyber targets because they directly affect public confidence and supply chains.
“You don’t need to knock out the entire energy sector to create panic,” Filipek told Security magazine. “If fuel access slows, storage readings are manipulated, or operators are forced into manual processes, the impact can quickly move from technical inconvenience to real-world operational risk.”
He warned that if such cyber activity spreads nationwide, it could create major supply chain disruptions and economic stress. “Operators should be treating these systems as critical infrastructure, not back-office equipment,” Filipek added.
Why Iran is under suspicion
Investigators say Iran is a top suspect because the country has a history of targeting these specific gas tank systems, as per CNN. They also said that the US government might never be able to officially prove who did it because the hackers did not leave behind enough digital evidence.
If Iran’s involvement is proven, it would be the latest attempt by Tehran to target critical American infrastructure during the ongoing US-Israeli war on the country. Earlier, an Iran-linked group known as Handala allegedly used Telegram channels to compromise Gmail accounts linked to senior US officials.
The cyber incidents could also become politically challenging for the Donald Trump administration by turning more attention to high gas prices due to the Strait of Hormuz blockade.
Kevin Kirkwood, Chief information security officer at Exabeam, told Security magazine, “This is on the verge of a kinetic cyber attack.” He said the incident is “not really about gas stations,” but instead shows how cyberattacks are increasingly focused on real-world operational systems rather than only data theft.
“As organisations adopt more AI, agents, and digital workers to automate decisions and operations, the risk grows that compromised data or manipulated systems could trigger larger operational disruptions at machine speed,” Kirkwood said.
Iran’s growing cyber capabilities
Since the US-Israeli war on Iran began on February 28, hackers linked to Tehran have caused a series of disruptions, American officials said.
Yossi Karadi, head of Israel’s National Cyber Directorate, told CNN that Iran’s cyber activities during the war have shown “a significant increase in the scale, speed, and integration between cyber operations and psychological campaigns.”
Experts say that Iran’s tactics are evolving rapidly. Allison Wikoff, a director on PwC’s threat intelligence team, told CNN that Iran’s cyber operations “are now accelerating with faster iteration, more layered hacktivist personas, and likely AI-driven scaling for reconnaissance and phishing.”
She added that they are quickly creating “good-enough” harmful software and launching campaigns to steal and leak data from civilian infrastructure and the media.
Gabrielle Hempel, security operations strategist at Exabeam, said modern conflicts are increasingly moving into cyberspace. “The next war is going to have large portions that are waged online,” Hempel said. “You no longer need to ‘blow something up’ kinetically to create instability.”
She added that attacks on fuel monitoring systems sit in “a gray area between nuisance and legitimate disruption.”
