Suspected Iran-linked breach of automatic tank gauge (ATG) systems at US gas stations

On May 15, 2026, CNN reported — citing US officials — that unidentified hackers had breached automatic tank gauge (ATG) systems monitoring fuel inventory at gas stations across multiple US states. The compromised ATGs were directly exposed to the internet and not protected by passwords. In at least some cases the attackers tampered with the readings shown on tank displays; officials stated that no physical damage occurred and that the actual stored fuel levels were not altered as of the time of reporting. US officials named Iran as the leading suspect, citing Iran's documented history of targeting fuel-tank systems — the IRGC was reported by Sky News in 2021 to have singled out ATGs as cyberattack targets — but acknowledged that the lack of forensic evidence left behind may make it impossible to definitively attribute the activity to Iran rather than another actor. The disclosure is part of a broader escalation of Iran-linked cyber operations against US critical infrastructure following US-Israel strikes on Iran in late February 2026, a wave that also includes the CyberAv3ngers Rockwell / Allen-Bradley PLC campaign (CISA AA26-097A), disruptions at US oil, gas, and water sites, a wiper attack on medical-device maker Stryker, and the leak of FBI Director Kash Patel's private emails. Internet-exposed, unauthenticated ATGs have been a recognized ICS exposure class since at least the 2015 GasPot honeypot research, and Bitsight TRACE disclosed critical vulnerabilities in widely deployed ATG products in September 2024.

Tampering with tank-gauge display readings confirmed at an unspecified number of gas stations across multiple US states; no physical damage and no change to actual stored fuel volumes reported as of May 15, 2026. The primary documented risk is safety rather than supply: a manipulated or suppressed ATG reading could allow a fuel leak — potentially thousands of gallons reaching soil or water supplies — to go undetected by station operators. No injuries, spills, or fuel-supply disruption have been attributed to the breaches. Attribution to Iran remains unconfirmed pending forensic evidence.