Cyber operations have been part of the war between Iran, Israel and the United States since it began on February 28, 2026. Governments have published real advisories and real numbers. But the original version of this story also repeated several claims that come from partisan sources, date from other years, or I could not trace to any report.
This rewrite keeps what is documented and labels the rest. It also drops several timeline entries I could not confirm and corrects two major ones: the fake sirens in kindergartens happened in January 2025, not 2026, and Iran’s internet blackout did not last 47 days. For readers who run industrial systems or small businesses, the practical lessons are low-tech: don’t expose controllers to the internet, change default passwords and keep backups you can restore.
Quick summary
- Context: The U.S. and Israel launched strikes on Iran on February 28, 2026. A ceasefire was announced on April 7–8, and the wider confrontation continued.
- Israel’s numbers: The National Cyber Directorate counted about 4,800 hostile incidents in June 2026, up from about 1,600 in June 2025. That is the directorate’s own tally of incidents, not a count of successful attacks.
- U.S. advisory (April 7): Six agencies warned that Iranian-affiliated actors were disrupting internet-exposed Rockwell/Allen-Bradley PLCs. The flaw used was five years old.
- Gas stations (May): Tank-gauge displays were tampered with. U.S. officials suspect Iran, but the government has not publicly attributed it.
- Against Iran: Reported operations include a prayer-app hack and an internet collapse in March, and a June attack on four Iranian banks that nobody has claimed or officially attributed.
- Not verified: Handala’s oil-company claims, billboard hijacks, Israeli blackout operations and U.S. Cyber Command botnet takedowns.
Iran against Israel
The “tripling”
The head of Israel’s National Cyber Directorate, Yossi Karadi, told the German paper Die Welt that Israel logged about 4,800 hostile cyber incidents in June 2026, versus about 1,600 in June 2025, as The Next Web reported. Two cautions: it is a year-on-year comparison with a month when Israel and Iran were also at war in 2025, and the directorate did not publish how many were serious intrusions versus routine probing. Karadi also said critical infrastructure had so far held, while weaker small and medium firms, including law and accounting offices, sometimes had systems wiped.
Wipers against small companies
On March 24, Karadi said Iran-linked hackers had destroyed the data of more than 50 small Israeli businesses in recent weeks and hacked about 50 security cameras. Most victims had existing weaknesses, and he said stronger organizations were not affected, per Bloomberg via Insurance Journal. He also said Iran had not disrupted critical infrastructure such as energy grids, banks or hospitals, which contrasts with the original’s framing. “Spray and pray” is the earlier article’s interpretation of that pattern, not a quote from officials.
The kindergarten sirens: a 2025 incident
The original text placed the Maagar-Tec incident in the 2026 surge. It happened on Sunday, January 26, 2025. Attackers breached the vendor’s panic-button interface and set off siren sounds and Arabic songs in about 20 kindergartens, the Israel National Cyber Directorate said, per Calcalist. Handala claimed it, and The Record notes that Trellix had cautioned that its pro-Palestinian image could hide other objectives. The directorate advised customers to change passwords. The group is linked to Iran by security vendors, but I did not find an Israeli government statement formally tying it to Iran’s Ministry of Intelligence.
Claims I could not verify
The earlier text said Handala breached Sharjah National Oil Corporation and “Israel Opportunity Energy” for 1.3 TB. I found no report on either claim, so I removed it. The “Handala compromised Israeli officials’ devices” timeline entry from December 2025 is also unsourced.
Iran against the United States
PLC advisory AA26-097A
On April 7, the FBI, CISA, NSA, EPA, Department of Energy and U.S. Cyber Command warned that Iranian-affiliated actors had been disrupting internet-facing PLCs, mainly Rockwell Automation/Allen-Bradley, since at least March. They manipulated project files and data shown on HMI and SCADA screens, causing operational disruption and financial loss in government facilities, water and wastewater, and energy, Industrial Cyber reported. Security analysts tied the activity to CVE-2021-22681, a 2021 authentication bypass, as one summary noted, and to a group often called CyberAv3ngers, which analysts link to the IRGC. Censys counted 5,219 exposed Rockwell devices worldwide, per Cyber Security News.
Update: IOActive reported in late July that the advisory was updated to include Siemens and Schneider Electric devices, with new indicators and mitigation guidance. The earlier text’s “water systems” claim is supported by the advisory’s mention of water and wastewater.
Gas-station tank gauges
On May 15, CNN reported that hackers got into automatic tank gauge (ATG) systems at gas stations in several states. The gauges were online with no password, and in some cases the attackers changed the readings shown on displays but not the actual fuel levels, as a syndicated copy put it. Officials suspected Iran but cautioned that evidence might not allow definitive attribution. The earlier text said “suspected” correctly but implied the hackers reached fuel supplies. Nothing reported shows physical effects. Later, a joint federal advisory warned that more than 900 ATG systems were exposed online, per BleepingComputer, without naming a group.
Phone tracking and leaks
The New York Times reported, as relayed by the Times of Israel, that researchers saw a surge in signals consistent with attempts to locate U.S. personnel through phone networks. A U.S. official said any claim that this data mattered to targeting “is a departure from the facts.” The original said operatives “tracked the phones of U.S. military personnel.” That overstates it: the report describes attempts that researchers observed, not confirmed success. Iran-linked hackers also leaked the old personal emails of FBI director Kash Patel, a case reported by CNN.
Operations against Iran
These are mostly reported by journalists and researchers, and governments rarely confirm them.
- March 1–2: Users of the BadeSaba prayer app received notifications urging people to rise up, per TechCrunch. The Wall Street Journal attributed it to Israel, and state news sites such as IRNA were also reported hijacked, according to Axios. The Financial Times reported that Israel had access to “nearly all” Tehran traffic cameras.
- Internet shutdown: The earlier text said Iran disconnected for 47 days in January. NetBlocks measured an 88-day near-total outage ending on May 26, calling it the longest nationwide shutdown in modern history, per RFE/RL. Monitors attributed the March collapse to a mix of strikes and cyber disruption.
- Iranian banks (June 2026): A cyberattack hit card payments, online banking and ATMs at Banks Melli, Saderat and Tejarat and the Export Development Bank, and Iran’s Cyber Command confirmed an attack on banking infrastructure. Suspicion fell on Predatory Sparrow, but analysts said attribution needed more evidence, AGBI reported.
- Mehdi Farhadi: Iran International reported that this FBI-wanted hacker was killed in a strike in Hamadan, based on funeral announcements, per its review. I found no U.S. or Israeli confirmation. He was wanted for intrusions and website defacements, not “national security data theft” by itself.
I removed several earlier claims for lack of sources: hijacked digital billboards and gas-station screens before an Israeli strike (a known tactic of the same group in 2021, not something I found in 2026), Israeli operations that cut Iranian electricity, attacks on Iranian drone and missile supply chains, and U.S. Cyber Command botnet takedowns. U.S. Cyber Command did co-author the April advisory, but I found no report of the specific operations the original described.
Claim check
| Claim | Status | Note |
|---|---|---|
| Iranian attacks on Israel tripled in June 2026 | Official tally | 4,800 vs 1,600 incidents, year on year. |
| Kindergarten sirens hack in 2026 | Wrong year | January 26, 2025. |
| Wipers hit 50+ small Israeli firms | Official claim | Said March 24; critical infrastructure not disrupted. |
| Handala breached Sharjah oil firm (1.3 TB) | Unverified | Removed. |
| April 2026 advisory on Rockwell PLCs | Confirmed | AA26-097A, April 7; updated later. |
| Iran hacked gas-station tank readers | Suspected | Officials suspect Iran; no public attribution. |
| Iran tracked U.S. military phones | Attempts reported | A U.S. official disputes the impact. |
| Iran offline for 47 days in January | Wrong | 88-day near-total outage ending May 26. |
| Cyberattack on Iranian banks in June | Confirmed by Iran; unattributed | Predatory Sparrow suspected. |
| Israeli hijack of billboards and fuel screens | Unverified for 2026 | Removed. |
| Farhadi killed in strikes | Reported, unconfirmed | Iran International only. |
My take
I haven’t investigated these incidents myself. These views come from advisories and press reports.
- The documented damage is mostly from basic exposure. A five-year-old PLC flaw, tank gauges with no password and small firms with weak defenses account for much of what was confirmed. That is less cinematic than “cyber warfare,” and more useful to know.
- Counts need context. “Tripled” compares a war month with the same month a year earlier, and incidents are not the same as breaches. Both sides also have reasons to emphasize their opponent’s activity.
- One criticism: the original treated claims by hacktivist groups and by anonymous “reports” as equal to government advisories. I’d weigh them very differently, especially for attacks on Iran, where confirmation is rare.
What this means for you
- Take PLCs and tank gauges off the public internet. Use a VPN or jump host, remove default or blank passwords, and keep logic backups, as the advisory recommends.
- Patch old flaws. CVE-2021-22681 is a 2021 vulnerability. Check vendor guidance for Rockwell, Siemens and Schneider devices.
- Protect small businesses against wipers. Keep offline or immutable backups, remove unneeded internet-facing services and enable multi-factor authentication.
- Change vendor-portal passwords for alarm, panic-button and building systems, as Israel’s directorate advised after the Maagar-Tec incident.
- Treat attributions as provisional. When a headline says “Iran did it” or “Israel did it,” check whether it comes from a government, a vendor, a hacktivist group or an unnamed source.
FAQ
Did Iran really triple its attacks on Israel?
Israel’s cyber directorate counted about 4,800 incidents in June 2026 versus about 1,600 in June 2025. These are the directorate’s own figures for incidents, not confirmed successful attacks.
Did Iranian hackers affect U.S. fuel supplies?
Not according to anything I found. They reportedly changed readings on tank-gauge displays, and officials said the actual fuel levels weren’t altered.
Is Handala a hacktivist group?
It presents itself as one. Security vendors link it to Iran’s intelligence ministry, though Israel and the U.S. have not formally attributed every operation.
Sources
- The Next Web: Karadi on the tripling of incidents
- Bloomberg via Insurance Journal: wipers on Israeli firms
- Calcalist: Maagar-Tec kindergarten breach
- The Record: hijacked sirens in Israel
- Industrial Cyber: PLC advisory
- DeNexus: AA26-097A analysis
- Cyber Security News: Censys exposure count
- IOActive: updated advisory
- People’s Daily (CNN report): gas-station breaches
- BleepingComputer: exposed tank-gauge systems
- Times of Israel: phone-tracking report
- TechCrunch: hacks and outages in Iran
- Axios: hackers join the war
- RFE/RL: end of Iran’s internet blackout
- AGBI: cyberattack on Iranian banks
- Iran International: Farhadi report
- Britannica: 2026 Iran war