Quick Answer
In May 2026, US officials briefed on the investigation said hackers, suspected by intelligence agencies to be linked to Iran, breached Automatic Tank Gauges (ATGs) at multiple US gas stations. The systems monitor fuel levels and detect leaks, and many were exposed to the public internet without password protection.
So far, no fuel was actually altered or spilled, but attackers were able to tamper with display readings. The Cybersecurity and Infrastructure Security Agency (CISA) is urging station owners to disconnect ATGs from the internet, replace default passwords and audit their systems immediately.
The breach is part of a wider Iranian cyber campaign during the ongoing US and Israeli conflict with Tehran that began in late February 2026.
What exactly did hackers target?
The intrusions focused on Automatic Tank Gauges, the sensors and controllers that sit on top of underground fuel tanks at gas stations. ATGs report fuel volume, temperature and water contamination back to station operators and distributors.
Investigators found that thousands of these systems across the United States had been left connected directly to the public internet, often with default or missing passwords. That made remote access trivial for anyone who knew where to look.
According to officials briefed on the inquiry, attackers tinkered with display readings on compromised gauges but, as of mid May 2026, had not altered actual fuel levels or caused spills.
Why is an ATG breach a serious problem?
On the surface, fuel level sensors sound mundane. In practice, ATGs sit at the intersection of environmental safety, supply chain stability and physical infrastructure.
- Blinded leak detection: ATGs are the primary defense against underground fuel leaks. A disabled sensor means a station can spill thousands of gallons of fuel into local soil and water without ever triggering an alarm.
- Economic sabotage: By spoofing inventory readings, attackers could trick distributors into halting deliveries to stations that are actually running dry, creating localised gas shortages.
- Physical damage: Some ATG controllers can drive relays and pump hardware. Researchers warn that a determined attacker could push equipment into states that cause permanent damage.
Why is Iran the prime suspect?
Officials have been careful to note that hard forensic attribution is difficult, but several factors point at Tehran linked actors.
- Historical targeting: Internal Iranian Islamic Revolutionary Guard Corps documents previously identified ATGs as attractive targets for disruptive attacks.
- Recent escalation pattern: Since the conflict began in February 2026, Tehran linked groups have been tied to disruptions at US water utilities, oil and gas facilities and medical device manufacturers.
- Asymmetric strategy: With the US homeland out of reach of conventional Iranian military assets, low cost cyberattacks on civilian infrastructure are a logical pressure tool.
What is CISA telling gas station owners to do?
The Cybersecurity and Infrastructure Security Agency has issued urgent guidance with a tight, practical checklist.
- Disconnect: Take ATGs off the public internet entirely. Use a private network or local only access.
- Replace credentials: Remove all factory default passwords and switch to long, unique credentials managed by a password manager.
- Patch and update: Apply firmware updates from ATG vendors as soon as they are released.
- Audit logs: Regularly review access logs and sensor readings for anomalies, especially repeated logins from unfamiliar IP addresses.
- Segment networks: Keep ATG systems on a separate network segment from point of sale, CCTV and back office systems.
How worried should drivers be?
For day to day fueling, the immediate risk to drivers is low. Pumps still work, payments still work and there is no public evidence of fuel quality being affected.
The bigger concern is structural. The breach is another reminder that critical civilian infrastructure, from water utilities to fuel logistics, increasingly sits on internet exposed industrial systems that were never designed for hostile state level adversaries.
The bottom line
The May 2026 ATG breach did not cause spills or shortages, but it exposed a glaring weakness: thousands of fuel sensors sitting on the open internet during an active geopolitical conflict. Expect tougher rules, faster patching cycles and a long overdue conversation about who is responsible for securing the soft underbelly of US energy infrastructure.
What Was Actually Breached
Researchers and federal cyber authorities confirmed that attackers compromised automatic tank gauging systems at multiple US gas stations. These devices monitor fuel levels and detect leaks, and many were left exposed to the public internet with default credentials.
Who Was Behind the Attacks
- A mix of opportunistic actors and politically motivated groups.
- Activity tied to broader patterns of probing critical infrastructure.
- Some incidents linked to known nation state aligned campaigns.
What the Attackers Could Do
Direct manipulation possibilities include altering tank level readings, disabling leak detection alarms, and potentially triggering overflow conditions. The risk is less about stealing data and more about creating physical safety and environmental hazards.
Why So Many Systems Were Exposed
Many automatic tank gauges were installed years before cybersecurity became a routine consideration in physical infrastructure. Default passwords, internet exposed serial to IP converters, and absent patching programs combined to create a soft target.
What Operators Should Do Immediately
- Remove tank gauges from direct internet exposure.
- Change default passwords and enforce strong credential policies.
- Place devices behind firewalls or VPN access only.
- Update firmware to versions that include recent security patches.
The Regulatory Response
The Cybersecurity and Infrastructure Security Agency has issued specific guidance for fuel station operators, and several states are considering rules that would require minimum cybersecurity standards for new and existing installations.
Lessons for Operational Technology Broadly
The incident is a reminder that operational technology across many industries shares the same vulnerabilities: legacy devices, weak default configurations, and limited patch lifecycles. Treat every internet connected industrial control device as a security priority, not an afterthought.
