Eight U.S. agencies are warning that hackers have been actively compromising automatic tank gauge systems, the devices that monitor fuel and liquid levels at storage tanks across critical infrastructure.
CISA, the FBI, the NSA, and five other federal departments say cyber actors have been targeting ATG systems left directly exposed to the internet, gaining access through authentication bypass flaws, hardcoded credentials, SQL injection, and privilege escalation. Once inside, attackers can modify pump controls, alter tank volume readings, and disable the alarms designed to catch leaks or relay failures. The government has not attributed the campaign to any nation-state or specific threat group. Affected sectors include energy, chemical, food and agriculture, and transportation.
The real-world stakes set ATG compromises apart from typical network intrusions. An attacker with control over a tank gauge can create what the advisory calls a "denial of view" condition, manipulating readings so operators cannot tell that a tank is dangerously overfull or that a leak is already underway. That can mean physical damage to tank systems, environmental hazards, and no automatic warning that anything has gone wrong.
The recommended fixes are straightforward: remove ATGs from the public internet, change default passwords, apply patches. Security researchers documented critical vulnerabilities in these same systems in 2023, and the agencies are essentially amplifying advice that has been on the table for nearly three years.