# Over 900 US Gas Station Tank Gauge Systems Exposed to Active Cyberattacks
Critical infrastructure organizations across the United States are facing an urgent security crisis. More than 900 automatic tank gauge (ATG) systems—electronic devices that monitor fuel and chemical storage across gas stations and industrial facilities—have been discovered exposed to the internet and actively targeted by threat actors, according to a joint advisory issued this week by the Cybersecurity and Infrastructure Security Agency (CISA), the FBI, the NSA, the Department of Energy, and other federal partners.
The discovery comes on the heels of confirmed attacks by Iranian-linked hackers and underscores a troubling trend: critical infrastructure operators continue to expose sensitive industrial control systems to the internet with minimal security protections. With attackers exploiting hardcoded credentials and authentication bypasses to gain control of these systems, the risk of fuel leaks, equipment damage, and operational disruption has escalated significantly.
## The Threat: Widespread Exposure and Active Exploitation
Security researchers at Shadowserver, an internet monitoring organization, identified 1,061 ATG systems exposed online globally, with 909 in the United States alone. The devices were detected on port 10001/tcp after researchers filtered out honeypots and false positives from ports 8001 and 9001.
Federal agencies confirmed that threat actors are actively exploiting these exposed systems through a series of attack techniques:
Once successfully compromised, attackers can modify system settings and disable critical safety features. Most concerning: they can disable system alerts that detect fuel leaks or equipment failures, potentially allowing hazardous conditions to develop undetected.
## What Are Automatic Tank Gauge Systems?
ATG systems are industrial monitoring devices designed to provide real-time visibility into the contents of storage tanks. At gas stations, these systems continuously track fuel levels, automatically alerting staff when inventory runs low and triggering reorders. They also monitor for environmental leaks—a critical safety and regulatory compliance function.
Beyond retail gas stations, ATGs are deployed across critical infrastructure sectors:
| Deployment Type | Purpose | Risk if Compromised |
|---|---|---|
| Gas stations | Fuel inventory monitoring | Leak detection failure, supply chain disruption |
| Chemical plants | Hazardous material tracking | Environmental contamination risk |
| Oil refineries | Product inventory management | Safety system compromise |
| Utilities | Tank level monitoring | Service disruption |
| Environmental compliance | Leak detection and reporting | Regulatory violations, environmental harm |
The devices are designed for remote monitoring, often connected to centralized management dashboards. This connectivity—intended to improve operational efficiency—has created a significant attack surface when these systems are exposed directly to the internet without proper security controls.
## Technical Vulnerabilities: How Attackers Gain Control
The vulnerabilities being exploited in ATG systems reflect fundamental security gaps in industrial control system design:
Hardcoded Credentials: Many ATG manufacturers embed default usernames and passwords in device firmware. These credentials are often publicly documented or easily discoverable, allowing attackers to authenticate without legitimate access rights.
Authentication Bypasses: Some ATG systems implement weak or flawed authentication mechanisms that can be circumvented through specially crafted requests or parameter manipulation.
SQL Injection: Poorly sanitized inputs in web interfaces or remote monitoring portals allow attackers to inject malicious SQL commands, potentially extracting sensitive configuration data or modifying system behavior.
OS Command Execution: Vulnerabilities in device management interfaces can allow attackers to execute arbitrary operating system commands, providing direct system control.
Privilege Escalation: Once initial access is gained, attackers exploit additional flaws to escalate from limited user accounts to administrative privileges.
The severity of these vulnerabilities is amplified by the fact that many organizations operate these systems with default configurations and have not applied available security patches.
## Prior Incidents: Attribution and Escalation
The current wave of ATG system compromises did not emerge in a vacuum. In May 2026, CNN reported that Iranian-linked hacking groups had successfully breached ATG systems at multiple gas stations across the United States. While those attackers manipulated display readings without altering actual fuel levels—causing no immediate physical damage—the incidents revealed the vulnerability of these systems to state-sponsored actors.
The Iranian connection is significant. These hacking groups have a documented history of targeting fuel management systems and industrial control technologies, suggesting a strategic interest in disrupting U.S. energy infrastructure.
This follows an April 2026 joint advisory in which U.S. federal agencies linked Iranian state-backed hackers to attacks against Rockwell Automation and Allen-Bradley programmable logic controllers (PLCs)—core components of industrial control systems. That campaign caused documented financial losses and operational disruptions. Researchers at Censys subsequently reported that 74.6% of exposed industrial control systems discovered online globally (3,891 hosts) originated from the United States, indicating a critical infrastructure protection gap.
## Implications for Critical Infrastructure
The compromise of ATG systems presents multi-layered risks to U.S. critical infrastructure:
Safety System Failures: Disabling leak detection alerts could allow hazardous fuel or chemical spills to escalate unchecked, creating environmental contamination and public health risks.
Supply Chain Disruption: Compromised inventory management could disrupt fuel distribution networks or cause artificial shortages that affect consumers and dependent businesses.
Regulatory and Financial Exposure: Environmental spills or compliance failures resulting from compromised monitoring systems could trigger significant regulatory penalties and litigation.
Operational Disruption: Complete system takeover could render tank monitoring inoperable, forcing manual inventory tracking and operational delays.
Espionage Risk: State-sponsored actors may be less interested in causing immediate damage than in maintaining persistent access for intelligence gathering or future operational capability.
## Recommendations and Immediate Actions
Federal agencies and security experts recommend a multi-layered mitigation strategy:
Immediate Actions (Days 1-7):
Short-Term Measures (Weeks 2-4):
Long-Term Hardening:
---
## HackWire Analysis
This incident represents a critical failure in security-by-design principles for industrial control systems. The fact that over 900 ATG systems remain exposed to the internet—and are actively being targeted—reflects a troubling gap between threat awareness and actual security implementation.
What's remarkable is the pattern: federal agencies have been issuing warnings about exposed industrial control systems for years. Yet critical infrastructure operators continue to deploy monitoring devices directly to the internet with default credentials intact. This suggests the problem isn't primarily a lack of information; it's a lack of operational discipline, budget prioritization, or accountability.
The Iranian nexus is particularly telling. These actors have demonstrated sustained interest in U.S. fuel and energy infrastructure. Previous ATG compromises may have been reconnaissance probes—testing access, evaluating damage potential, and maintaining backdoors for future use. The current advisory may represent the moment when multiple actors coordinated or escalated their activities, triggering government detection.
What defenders should understand: these aren't new vulnerabilities. The flaws being exploited—hardcoded credentials, SQL injection, weak authentication—are decades-old attack patterns. That critical infrastructure operators are still vulnerable to these attacks suggests systemic failures in procurement, patch management, and security governance.
For organizations operating ATG systems: treat this as an immediate action alert. Assume your systems have been scanned and catalogued by threat actors. Implement network segmentation and access controls today, not next quarter. For government agencies and critical infrastructure regulators: the current approach of issuing advisories is insufficient. Enforcement mechanisms, mandatory compliance timelines, and vulnerability disclosure requirements for manufacturers are overdue.
— HackWire Editorial
---
## Related Coverage