Over 900 automatic tank gauge (ATG) systems across the United States, which monitor fuel and chemical storage tanks, have been found exposed to the internet and vulnerable to active cyberattacks. The US Cybersecurity and Infrastructure Security Agency (CISA), FBI, NSA, and other federal partners issued a joint advisory highlighting that attackers exploit multiple security weaknesses including hardcoded credentials, authentication bypasses, SQL injection, OS command execution vulnerabilities, and privilege escalation to compromise these devices. Once compromised, attackers can modify system settings, disable alerts, and potentially cause leaks or permanent damage to tank systems. Shadowserver reported over 1,000 exposed ATG systems globally, with 909 in the US. Iranian state-backed hackers have been linked to some attacks manipulating display readings without altering actual fuel levels. The advisory recommends restricting remote access, replacing default passwords, applying security updates, and implementing multi-factor authentication. No official patch or remediation status is provided in the advisory.

The exposure and compromise of ATG systems can lead to attackers disabling critical system alerts, increasing the risk of undetected fuel or chemical leaks, equipment failures, and potential permanent damage to storage tanks. Manipulation of system readings can disrupt inventory control and safety monitoring functions. Although no physical damage has been reported in linked incidents, the vulnerabilities pose a critical risk to operational safety and environmental compliance in critical infrastructure sectors. The threat is ongoing with active exploitation attempts reported.

Federal agencies advise critical infrastructure organizations to immediately restrict internet exposure of ATG systems by implementing firewalls, VPNs, or access control lists. Default and weak passwords should be replaced with strong credentials. Organizations should apply any available security updates and patches from vendors, monitor systems for unauthorized changes, and enable multi-factor authentication where supported. Since no official patch status is confirmed, organizations must check vendor advisories regularly for updates. The advisory emphasizes controlled remote access and credential management as primary mitigations.