Iran nationwide fuel-distribution cyberattack

On 26 October 2021, a cyberattack disabled the electronic system that lets millions of Iranians buy government-subsidized fuel, knocking out fuel payments at effectively all 4,300 gas stations in the country and forcing long queues nationwide.

What happened

Iran rations subsidized gasoline through government-issued smart cards; drivers swipe a card to buy fuel at the cheaper subsidized price. The attack targeted the central system behind those cards, causing pumps across the country to fail. Affected stations displayed the message "cyberattack 64411" — a pointed reference to the telephone hotline run by Supreme Leader Ali Khamenei's office. In parallel, attackers hijacked digital highway billboards in Tehran and elsewhere to display the message: "Khamenei, where is our fuel?"

The fuel network runs on Iran's isolated National Information Network rather than the public internet, making the breach especially alarming for Iranian authorities. The Ministry of Petroleum initially attributed the outage to a "technical fault" before officials confirmed a deliberate cyberattack.

Impact

• The subsidized-fuel-payment system failed at all of Iran's roughly 4,300 stations, with reporting citing about 70% rendered inoperable for subsidized sales.
• Long vehicle queues and public frustration spread across major cities; some stations reverted to selling at non-subsidized prices.
• Recovery took several days; on 5 November authorities issued compensatory fuel quotas of 10 liters per car and 5 liters per motorcycle while systems were restored.

Attribution

The group Predatory Sparrow (Gonjeshke Darande) claimed responsibility and tied the operation to earlier 2021 attacks on Iranian rail assets. Iranian officials, including civil-defense chief Gholamreza Jalali, blamed the United States and Israel; U.S. defense officials, speaking anonymously to the New York Times, attributed the attack to Israel. Predatory Sparrow's polished, disruption-with-messaging style closely mirrored the earlier railway incident.

Why it matters

The fuel-station attack showed how a strike on a single back-end payment system could create nationwide disruption to a daily necessity, weaponizing public inconvenience for political pressure. By breaching a network on Iran's supposedly isolated National Information Network and pairing it with billboard psychological operations, it set the pattern for Predatory Sparrow's later, more physically destructive operation against Iran's steel plants.