A brief timeline of Iranian cyberattacks on U.S. companies, political figures, water systems and more

Timeline of Reported Cyber Incidents Linked to Iranian Actors Targeting U.S. Systems

Investigators continue to examine whether Iranian-linked actors carried out recent malicious cyber activity affecting water systems in seven states, including Minnesota. Attribution in such cases typically requires weeks or months of technical analysis. Iranian officials have consistently denied involvement in cyberattacks. The 2026 incidents remain under active investigation with no formal attribution established as of the latest reporting.

The following entries summarize publicly reported incidents attributed by U.S. authorities to Iranian-linked actors, with details on documented effects where available.

2011-2013: Distributed denial-of-service activity against U.S. banks

The Justice Department charged seven Iranian nationals employed by entities connected to the Iranian government and Islamic Revolutionary Guard Corps with conducting distributed denial-of-service attacks on 46 financial institutions. Court documents stated that the activity rendered some bank websites inaccessible to customers for periods of time. The department reported remediation costs in the tens of millions of dollars across affected institutions and customers.

2013: Access to New York dam control systems

The same indictment included charges against one defendant for accessing the control system of the Bowman Avenue Dam in Rye, New York. Records indicate the actor viewed operational data, but the sluice gate remained disconnected for scheduled maintenance throughout the period of access, resulting in no operational change.

2014: Activity targeting Las Vegas Sands

Las Vegas Sands reported that its corporate network experienced data wiping, website defacement containing statements critical of CEO Sheldon Adelson, and the theft of personal information belonging to tens of thousands of customers, including Social Security and driver’s license numbers. Then-Director of National Intelligence James Clapper attributed the operation to Iran during congressional testimony, describing it as the first destructive cyber operation on U.S. soil attributed to a nation-state actor.

2016-2021: Access attempts involving federal agencies and contractors

A 2024 Justice Department indictment described a campaign by Iranian hackers that began by 2016 and continued at least through 2021. Targets included the State Department, Treasury Department, defense contractors holding classified information, an accounting firm, and a hospitality company. The defendants were employed by a firm that presented itself as providing cybersecurity services; one was also alleged to have worked in the electronic warfare division of the Islamic Revolutionary Guard Corps.

2017-2024: Compromises of educational, municipal, healthcare, and financial entities

The FBI and Cybersecurity and Infrastructure Security Agency reported that Iranian government-associated actors, tracked under names including Pioneer Kitten, gained access to networks belonging to schools, municipal governments, healthcare organizations, and financial institutions. In multiple instances, the actors maintained access and transferred control to ransomware operators who then demanded payment. Federal statements noted that the ransomware activity itself was not assessed as government-directed, while separate targeting of defense sector networks aligned with Iranian government interests.

2019-2021: Access to John Bolton email account

Federal prosecutors stated in a 2025 indictment that an actor assessed as Iran-linked accessed an email account belonging to former National Security Advisor John Bolton. The indictment referenced a subsequent message received by Bolton warning that leaked content could prompt FBI involvement.

2020: Email campaigns and voter data access attempts

Shortly before the 2020 election, voters in Florida and other states received messages purporting to originate from the Proud Boys. The U.S. intelligence community later assessed that Iran was responsible. Separate Justice Department charges described Iranian hackers exploiting a misconfigured system to obtain voter data from one state and attempting access in others. The actors then sent messages to registered Democrats and staged material directed at Republican officials. The intelligence assessment concluded that Iran sought to damage the Trump campaign and reduce public confidence in the process but did not attempt to alter election infrastructure. The FBI separately attributed a website displaying threats against election officials to Iranian actors.

2021: Attempted access involving Boston Children’s Hospital

Former FBI Director Christopher Wray stated that the bureau disrupted an Iranian-linked operation targeting Boston Children’s Hospital. CISA reporting from the same period described Iranian-sponsored actors scanning an unnamed pediatric hospital and a municipal government.

2023-2024: CyberAv3ngers activity against industrial control devices

CISA documented activity by the group CyberAv3ngers, assessed as affiliated with the Islamic Revolutionary Guard Corps, targeting programmable logic controllers manufactured by Unitronics. The devices were often configured without passwords or with default credentials. Compromised devices displayed a message referencing Israel. In Aliquippa, Pennsylvania, operators responded by switching affected water pumping equipment to manual control, avoiding service interruption. Similar scanning occurred against water and wastewater systems in the United States and Israel.

2024: Account access and information distribution involving political campaigns

The Justice Department charged three Iranian nationals employed by the Islamic Revolutionary Guard Corps with gaining access to accounts of current and former officials, journalists, and political campaigns. The stated objectives included obtaining information potentially useful for retaliation related to the 2020 death of Qasem Soleimani and distributing material to create discord. Access was achieved to accounts linked to one presidential campaign, later identified in reporting as the Trump campaign. The Trump campaign stated that internal documents had been taken and distributed. The FBI also examined possible Iranian interest in Biden-Harris campaign emails.

2026: Reported activity involving medical technology company

The Justice Department seized domains used by groups including Handala to claim responsibility for operations and publish stolen data. Handala asserted responsibility for a March 2026 incident involving Stryker, a medical technology company. The underlying attribution remains under review.

2026: Reported access to Kash Patel email account

CBS News reported that Iranian-linked actors accessed the personal email account of FBI Director Kash Patel, with the Handala group claiming responsibility. The incident continues under investigation with no final attribution issued.

These entries reflect statements from the Justice Department, FBI, CISA, and intelligence assessments. Many documented cases involved reconnaissance or limited effects due to existing maintenance states or rapid operational responses by targeted organizations.