Handala

A hacker-activist group called Handala claimed responsibility for a cyber intrusion targeting water facilities in California, stating the action was retaliation for alleged US strikes on water infrastructure in southern Iran. The group obtained data from the systems and published 5 gigabytes of evidence, warning Washington while claiming to have refrained from disrupting water supplies.

Iranian-linked hackers launched systematic cyberattacks against U.S. infrastructure following military operations in February 2026, including a major attack on medical technology company Stryker that wiped 80,000 devices and stole 50 terabytes of data. Despite destruction of Iran's primary cyber command center in Tehran, Iranian threat actors quickly adapted using alternative communication methods and infrastructure to continue operations targeting critical U.S. oil, gas, and water facilities.

Iran's cyberwar is targeting ordinary Americans, with hackers using stolen passwords and basic malware to breach systems, including those of high-profile individuals and companies. The Iranian Revolutionary Guard Corps has been moving hundreds of millions of dollars in crypto to fund its proxies. The US has the tools to dismantle the hacker network.

Missile and drone attacks on cloud data centers in the Middle East have highlighted the critical vulnerability of digital infrastructure, which is increasingly reliant on AI workloads. Data centers are now a high-value target due to their importance in supporting AI and national security systems. Attacks on these infrastructures can inflict significant damage beyond financial losses.

Iran-backed hacktivist group Handala claimed responsibility for a data-wiping attack on Stryker, a global medical technology company, in retaliation for a U.S.-attributed missile strike that killed many children.