In April 2026 the grid-edge supplier Itron told investors no intruder activity had been observed in its customer-hosted systems. Seven days later it amended the filing: limited unauthorized access to certain of them.
Most corrections in this book are someone else’s reading of a document. This one is a company revising its own. On 24 April 2026 Itron wrote that no unauthorized activity was observed in the customer hosted portion of its systems. On 1 May it wrote that its investigation had identified limited unauthorized access to certain customer-hosted systems. The first sentence was an observation made while the investigation was ongoing, and the second replaced it, toward more exposure, within seven days. Itron did its part.
Precision matters because Itron’s products sit at the grid edge, yet neither filing mentions meters, networks or the grid, or defines customer-hosted. Every customer reading the amendment had to ask whether it was among the certain systems, and only the vendor could answer. A supplier path that a customer cannot see, open or close is part of that customer’s attack surface. The fix is a path that exists only when the customer opens it.
What is not known: Itron has not said who told it about the intrusion, how the intruder got in, who it was, or what was taken. It has not defined customer-hosted systems, said how many were reached, or named any customer, and no utility has disclosed an impact that we could find. Neither filing mentions meters, networks or the grid. No cost figure exists. Whether any customer or regulator was notified is not stated; both filings describe that evaluation as ongoing.
Recommendation
Take the vendor’s standing path away A supplier’s corporate compromise should have no route into systems that run in your environment or on your behalf. Vendor connections open from your side, per job.
Remove standing vendor credentials No persistent vendor accounts, shared credentials or always-on tunnels into head-end or meter data systems. Every session named, time-boxed and logged by you.
Make the vendor’s view read one way Where a supplier only needs data for support or analytics, send it outbound over a one-way path, so the supplier can read without reaching back.
Sources: Itron Form 8-K, Item 8.01, filed 24 Apr 2026; Form 8-K/A, Item 8.01, filed 1 May 2026; Forms 10-Q, Q1 and Q2 2026; FY2025 Form 10-K; EDGAR full-text search, CIK 780571. Full list with links.
Soft Spots: “Customer-hosted systems” is undefined by Itron; nothing here should be read as meters or grid. The first filing was an observation during an ongoing investigation, not a denial. No utility impact was found; state portals were not searched.
The full record
Every claim numbered to its source. Last updated .
A grid-edge supplier told investors no intruder activity had been observed in its customer-hosted systems, then amended that seven days later. What is verified, what is only reported, and what is still unknown.
Summary
In April 2026 Itron, a supplier of metering and grid-edge products to utilities, disclosed unauthorized access to certain of its systems. Its 24 April filing, made while the investigation was ongoing, said no unauthorized activity was observed in the customer hosted portion of its systems; a 1 May amendment reported limited unauthorized access to certain customer-hosted systems. Neither filing defines the term or mentions meters or the grid.1,2
Timeline of the Itron incident and its two filings
Every date is tied to a source. Press reporting appears only as evidence of what was said.
Itron is notified that an unauthorized third party has gained access to certain of its systems. It activates its cybersecurity response plan and launches an investigation with external advisors. Who notified it is not stated.1,2
Eleven days after the notice, Itron files a Form 8-K under Item 8.01, the voluntary item. It has removed the activity, has seen none since in its corporate systems, and says "no unauthorized activity was observed in the customer hosted portion of its systems." Operations have continued, insurers are expected to cover a significant portion of direct costs, law enforcement has been notified, and the investigation is ongoing.1
BleepingComputer reports the disclosure and that no ransomware group has claimed the attack. The same day, a headline elsewhere says Itron's smart grid systems were breached, which neither filing says.5,8
The Register reports that Itron declined to say how the intruders got in or whether ransomware or extortion was involved. Cybersecurity Dive reports that Itron declined to comment on how it learned of the attack and which systems were compromised.4,9
Itron files its first-quarter Form 10-Q and holds its earnings call. Neither mentions the incident, on the terms we searched and in the third-party transcripts we read.6,10
Seven days after the first filing and eighteen after the notice, Itron files a Form 8-K/A, again under Item 8.01: "the Company has identified limited unauthorized access to certain customer-hosted systems." It has seen no evidence that customer-facing system functionality was materially affected, and still judges the incident immaterial.2
A trade article, five days after the amendment, still says customer-hosted environments were reportedly unaffected.11
World Pipelines, four weeks after the amendment, still repeats the first filing's line and does not mention the amendment.12
Itron files its second-quarter Form 10-Q and publishes its second-quarter results. No mention of the incident is found in either, or in the third-party transcript of that day's earnings call.7,10,13
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
No figure published. Insurers expected to cover "a significant portion" of direct costs1
Undisclosed
What did Itron's two filings say?
The first filing said no unauthorized activity had been observed in its customer-hosted systems; the amendment, seven days later, said the investigation had identified limited unauthorized access to certain of them. Both are Itron's own words, filed with the SEC under Item 8.01 and signed by its chief financial officer, Joan S. Hooper.1,2 The first, on 24 April 2026:
"The Company took action to remediate and remove the unauthorized activity and has not observed any subsequent unauthorized activity within its corporate systems. Further, no unauthorized activity was observed in the customer hosted portion of its systems."
The amendment, on 1 May 2026:
"Based on the investigation to date, the Company has identified limited unauthorized access to certain customer-hosted systems. The Company has not observed any evidence that customer-facing system functionality was materially affected."
Read side by side, the two filings also differ in smaller ways:1,2
The first says Itron "was notified"; the amendment says it "was informed."
The first says no further activity was seen "within its corporate systems"; the amendment says "in its systems," and the split between corporate and customer-hosted is gone.
Only the first credits continued operations to "contingency plans and data backup systems."
Only the first mentions insurers and law enforcement. The amendment does not repeat either. Its Explanatory Note says it was filed "solely to provide an update," so leaving something out of the update is not a retraction.
Both say the evaluation of filings and notifications is under way, and both judge the incident immaterial.
Did Itron deny that customer systems were accessed?
No. The first filing reported what had been observed during an investigation it said was ongoing; it did not find that no access had occurred. The sentence reads "no unauthorized activity was observed," and the same filing says "the Company's investigation and assessment of this incident is ongoing."1 The amendment replaced that observation with a finding. A correction of an observation is not a walk-back of a denial.
Both filings were made under Item 8.01, the voluntary item, and Itron said throughout that it did not believe the incident was material.1,2 It volunteered the first filing eleven days after being notified and amended it within a week, in the direction of more exposure, not less. Nothing on the record says Itron was obliged to file, filed late, or withheld anything, and this entry does not suggest it.
Were Itron's smart meters or the power grid compromised?
Nothing on the record says so. Neither filing mentions meters, networks, the grid or operational technology.1,2 Itron makes grid-edge products, which is why the question gets asked, but the company's product line is not the incident's scope.
Neither filing defines "customer-hosted systems." A full-text search of Itron's filings on SEC EDGAR finds the phrase "customer hosted" in these two documents and in no other Itron filing, so no Itron document defines it.3 The first filing's grammar, "the customer hosted portion of its systems," places those systems inside Itron's own; that is our reading of the sentence, not a disclosure. Whether they are systems Itron runs for customers, Itron software running in customers' environments, or something else is undisclosed.
No utility customer has publicly disclosed an impact that we could find. That is a statement about what we found: state breach-notification portals and utility commission dockets were not searched.
Who was behind the Itron incident, and was it ransomware?
Undisclosed. Itron has named no actor and no tool. Neither filing mentions malware, ransomware or encryption.1,2 BleepingComputer reported on 26 April 2026 that no ransomware group had claimed the attack, and we found no claim in our September 2026 review.5
Itron declined to answer The Register's questions about how the intruders gained initial access and whether ransomware was deployed or an extortion demand made.4 Cybersecurity Dive reported that Itron declined to comment on how it learned of the attack and which of its systems were compromised.9 Both filings put the notice in the passive voice, so whether it came from law enforcement, a customer, a researcher or a vendor is not stated.1,2
Did Itron mention the incident in its quarterly reports?
Not on the terms we searched. Itron filed its first-quarter Form 10-Q on 28 April 2026, four days after the first filing and three days before the amendment, and its second-quarter 10-Q on 28 July 2026.6,7 Neither contains "unauthorized," "cybersecurity," "the incident" or "insurers." The word "incident" appears in both only in a product description.3,6,7 We did not find the incident mentioned in third-party transcripts of the 28 April and 28 July earnings calls, or in Itron's second-quarter results release.10,13
This is a finding about scope, not a criticism. The filings that describe the incident are the two Item 8.01 reports, and the company said in both that it did not consider the incident material.1,2
Did the news coverage catch the correction?
Not all of it. In the coverage we found, the superseded first line was still being repeated weeks after the amendment. A trade article on 6 May 2026, five days after the amendment, said customer-hosted environments were reportedly unaffected.11 World Pipelines on 28 May 2026, four weeks after, still said Itron found no unauthorized activity in the customer-hosted portion of its systems, with no mention of the amendment.12 One early headline went the other way, saying Itron's smart grid systems were breached, which neither filing says.8
This rests on a sample of the coverage, not a census. We do not say no outlet reported the amendment; we say we could not find the correction travelling as far as the first version did.
What is still not known about Itron
Who told Itron about the intrusion. Both filings use the passive voice.1,2
How the intruder got in, and who it was.
Whether ransomware or extortion was involved.
What, if anything, was taken.
What "customer-hosted systems" means. Neither filing defines it.1,2,3
How many customer-hosted systems were reached, and which customers they belong to or serve.
Whether any utility was affected. None has disclosed an impact that we could find; state breach portals and utility commission dockets were not searched.
Whether any customer or regulator was notified. Both filings describe that evaluation as ongoing.1,2
The cost. No figure exists; Itron calls the incident immaterial and expected insurers to cover a significant portion of its direct costs.1
Claims about Itron the record does not support
Widely repeated claim
What the record says
"Itron's smart grid systems were breached."
Neither filing mentions meters, networks, the grid or operational technology. The amendment says "certain customer-hosted systems," a term it does not define.1,2,8
"Itron found no unauthorized activity in its customer-hosted systems."
The 24 April filing said none "was observed," with the investigation ongoing. On 1 May Itron's own amendment superseded it: "limited unauthorized access to certain customer-hosted systems."1,2,11,12
BlastWave analysis: every vendor path is the customer's attack surface
Analysis, not a disclosed fact
Most corrections in this book are someone else's reading of a document. This one is a company revising its own. Itron filed both statements under the voluntary item, judged the incident immaterial throughout, and corrected toward more exposure within seven days. That is the disclosure rule doing what it is for, and Itron did its part.1,2 On the consequence ladder, the rung the record supports is an IT compromise with no physical operation halted on the record: vendor access to systems that belong to or serve customers, with operations continuing. BlastWave's reading, which is analysis and not a disclosed fact, is that it rises to OT-adjacent access only if those systems prove to be operational ones. Nothing on the record puts it higher.
The architecture lesson does not need that question settled. Every customer reading the amendment had to ask whether it was among the certain systems, and the only party able to answer was the vendor. A supplier path that a customer cannot see, open or close is part of that customer's attack surface, whether or not it appears on the customer's drawings. The fix is not a faster vendor investigation. It is a path that exists only when the customer opens it.
Podcast: “Not Us, Then Maybe” (8:59). Joe Baxter and Cam Cullen on why the filings did their job and the vendor's standing path into customer systems is the real problem.
Video: Itron Short (60 to 90 seconds).
Frequently asked questions
What happened in the Itron cyber incident?
Itron, a supplier of metering and grid-edge products to utilities, said in an SEC filing on 24 April 2026 that it was notified on 13 April that an unauthorized third party had accessed certain of its systems. That filing said no unauthorized activity was observed in the customer hosted portion of its systems. A 1 May 2026 amendment said the investigation had identified limited unauthorized access to certain customer-hosted systems. Both filings say its operations continued in all material respects.
Were Itron smart meters or the power grid hacked?
Nothing on the record says so. Neither of Itron's two filings, of 24 April and 1 May 2026, mentions meters, networks, the grid or operational technology. The amendment says only that there was limited unauthorized access to certain customer-hosted systems, a term it does not define, and that Itron had not observed any evidence that customer-facing system functionality was materially affected.
What are Itron's customer-hosted systems?
Itron has not said. Neither its 24 April 2026 Form 8-K nor its 1 May 2026 amendment defines the term, and a full-text search of Itron's SEC filings finds the phrase in those two documents only. Whether it means systems Itron runs for customers, Itron software in customers' environments, or something else is undisclosed, and this entry does not guess.
Did Itron deny that customer systems were accessed?
No. Itron's 24 April 2026 filing said no unauthorized activity was observed in the customer hosted portion of its systems, while also saying its investigation was ongoing. That was an observation, not a finding of absence. Its 1 May 2026 amendment, filed seven days later under the same voluntary item, replaced it with limited unauthorized access to certain customer-hosted systems.
Who hacked Itron? Was it ransomware?
Itron has not named an attacker or a tool, and neither of its 2026 filings mentions malware, ransomware or encryption. BleepingComputer reported on 26 April 2026 that no ransomware group had claimed the attack, and The Register reported on 27 April that Itron declined to say how the intruders got in or whether ransomware or extortion was involved.
Were any utilities affected by the Itron incident?
No utility customer has publicly disclosed an impact that BlastWave could find as of September 2026, though state breach portals and utility commission dockets were not searched. Itron's 1 May 2026 amendment said it had not observed any evidence that customer-facing system functionality was materially affected, and neither filing names a customer.
How much did the Itron incident cost?
No cost figure has been published. Itron said in both its 24 April and 1 May 2026 filings that it did not believe the incident was material, and the first filing said it expected a significant portion of its direct costs to be reimbursed by its insurers. Neither of its 2026 quarterly reports contains a cost figure for the incident.
Primary sources are Itron's own SEC filings and its results release, tested against SEC EDGAR full-text search. Earnings call content comes from third-party transcripts, and press is cited only as evidence of what was said.
Company filingItron, Inc., Form 8-K, Item 8.01, date of report 13 April 2026, filed 24 April 2026, signed by Joan S. Hooper, Senior Vice President and Chief Financial Officer (accession 0001193125-26-175249). sec.gov
Company filingItron, Inc., Form 8-K/A, Explanatory Note and Item 8.01, date of report 13 April 2026, filed 1 May 2026, signed by Joan S. Hooper (accession 0001193125-26-199316). sec.gov
Company filingSEC EDGAR, Itron, Inc. company record (CIK 780571, SIC 3825) and full-text search of its filings, run 24 September 2026 and checked again 28 September 2026: "customer hosted," 2 results (the 8-K and the 8-K/A only); "cyber" and "unauthorized" absent from both 2026 Forms 10-Q.
PressThe Register (Jessica Lyons), report on Itron, 27 April 2026. Cited for Itron's refusal to answer questions, as reported.
PressBleepingComputer (Bill Toulas), "American utility firm Itron discloses breach of internal IT network," 26 April 2026. Cited as evidence of what was reported. bleepingcomputer.com
Company filingItron, Inc., Form 10-Q, quarter ended 31 March 2026, filed 28 April 2026 (accession 0000780571-26-000110). Tested by full-text search terms. sec.gov
Company filingItron, Inc., Form 10-Q, quarter ended 30 June 2026, filed 28 July 2026 (accession 0000780571-26-000178). Tested by full-text search terms. sec.gov
PressAnavem, "Itron Smart Grid Systems Breached by Unauthorized Attackers," 26 April 2026, updated 27 April 2026. Cited as evidence of what was said.
PressCybersecurity Dive (Eric Geller), report on Itron, 27 April 2026. Cited for Itron's declining to comment, as reported. cybersecuritydive.com
PressItron first-quarter 2026 earnings call, 28 April 2026 (third-party transcripts by The Motley Fool and Investing.com), and second-quarter 2026 earnings call, 28 July 2026 (third-party transcript by Investing.com). Not Itron-published transcripts.
PressComputerbilities, article on the Itron incident, 6 May 2026. Cited as evidence of what was said after the amendment.
PressWorld Pipelines, special report on the Itron incident, 28 May 2026. Cited as evidence of what was said after the amendment. worldpipelines.com
CompanyItron, Inc., "Itron Announces Second Quarter 2026 Financial Results," 28 July 2026. investors.itron.com
Cite this page
BlastWave. “Itron Cyber Incident (2026): What Is Verified.” Hackopedia, Volume 2, FILE 033. Last verified 28 September 2026. https://hackopedia.blastwave.com/energy/itron-2026/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 033 in Hackopedia Volume 2, in the Energy edition.
28 Sep 2026
Hand-check on SEC EDGAR: the wording of both filings confirmed at source; full-text search confirmed that "customer hosted" appears only in the two filings and that neither 2026 quarterly report mentions the incident on the terms searched. Cross-entry consistency review.
26 Sep 2026
Full validation of every quotation, date and interval against Itron's filings, the earnings call transcripts and the coverage cited. The interval between the two filings confirmed as seven days.
24 Sep 2026
Volume 2 entry built from primary sources.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
