This was only vandalism, but if you read the manual...
There's a lot of other things you can do if you read the manual about how to interface with that model device.
For instance, if you (the evil black-hat bent on causing trouble) decided to, you could alter the amount of water reported to be in the tank - something which would call for a shutdown of fuel service and for someone to run a test on the tank to determine how much water is present.
Alternatively, you can change the tank's diameter to 0, which sets off all manner of alarms, some of which conflict with each other - a rather Hollywood sort of error condition, where everything lights up and buzzers sound and all that jazz.
Or you could change the reported fuel level to something miniscule, so that the fuel truck will attempt to deliver several hundred more gallons to the tank than there is space for, potentially resulting in a nasty spill.
Or why not change the threshold for the leak detection vapor pressure? This one's nice and subtle, and results in vastly reduced fuel flow at the pump, so those few who do stay around to pump fuel end up having to spend much longer (thus taking up space) at the pump than they would otherwise.
All of this is nicely documented in the manual from the manufacturer, freely available online to anyone with half a clue of what to look for.
Needless to say, attaching unauthenticated devices directly to the internet is a very bad idea, and those persons who made that choice need to be sacked forthwith.