RISI

← Back to database

Iran fuel stations cyberattack (Predatory Sparrow)

Event Year
2021
Reliability
Confirmed
Country
Iran
Industry
Petroleum
Attack Type
Targeted Attack

Description

On October 26, 2021, the centralized smart-card system that authorizes subsidized-fuel purchases at all 4,300 Iranian gas stations was disabled by a cyberattack later claimed by Predatory Sparrow (Persian Gonjeshke Darande), a pro-Israel persona widely assessed as linked to the Israeli government. Pumps across the country either failed or, at affected stations, displayed the Iranian Supreme Leader's hotline number "64411" in apparent mockery of the regime. Concurrent attacks defaced digital city billboards with messages reading "Khamenei, where is our fuel?". The subsidized-fuel program remained materially disrupted for approximately two weeks, with full restoration of card functionality reported on or about November 6 to 7. The incident followed Predatory Sparrow's July 9, 2021 attack on Iran's Islamic Republic of Iran Railways using the Meteor wiper, and is one of three publicly attributed Predatory Sparrow operations against Iranian critical infrastructure (rail, fuel, steel).

Impact

Approximately 4,300 fuel stations unable to dispense subsidized gasoline for periods ranging from 48 hours to 12 days; nationwide queues; suspension of the smart-card subsidy program; symbolic billboard defacement amplified domestic political pressure on the Raisi government. No deaths or injuries reported.

Sources