Iran Media Outlet Says Gas Widely Available After Cyberattack, Then Claims It Too Was Hacked

Iran's state-run IRNA news agency reported on Wednesday morning that gas was widely available in the county following a reported cyberattack on Tuesday that targeted Iran's gas stations. The agency quoted an official who claimed 80 percent of gas stations in the Islamic Republic had already starting selling fuel again, the Associated Press reported.

IRNA first referred to Tuesday's incident as a cyberattack and reported it saw people trying to purchase fuel with government-issued cards at gas machines getting a message that read: "cyberattack 64411." However, ISNA removed those reports later and said that it had also been hacked.

IRNA's reported the hack of its own services came after the Associated Press reported it still saw long lines at multiple gas stations in Tehran, including one station that had 90 cars waiting to pull up to the pumps. The AP said that customers who were able to buy gas did so at higher than usual prices.

The Associated Press also reported that IRNA's removal of its cyberattack stories and claims of hacking could have come as a result of upsetting Iran's theocracy.

IRNA's report of the messages containing "cyberattack 64411" did not explain the meaning of the number, but the digits also appear in a phone line connected to Supreme Leader Ayatollah Ali Khamenei's office that fields questions related to Islamic law.

For more reporting from the Associated Press, see below.

Iran gas station
In this photo cars and motorbikes are seen lining up to fill up at a service station in Iran's capital Tehran on October 26, 2021, amid a nationwide disruption of the petrol distribution system. Getty

Iran's president Ebrahim Raisi said Wednesday that the cyberattack which paralyzed every gas station in the country was designed to get "people angry by creating disorder and disruption," as long lines still snaked around the pumps a day after the incident began.

Raisi's remarks stopped short of assigning blame for the attack, which rendered useless the government-issued electronic cards that many Iranians use to buy subsidized fuel at the pump.

However, they suggested that he and others in the theocracy believe anti-Iranian forces carried out an assault likely designed to inflame the country as the second anniversary of a deadly crackdown on nationwide protests over gasoline prices approaches.

"There should be serious readiness in the field of cyberwar and related bodies should not allow the enemy to follow their ominous aims to make problem in trend of people's life," Raisi said. State television later aired footage of the president visiting a gas station in central Tehran.

The attack Tuesday also bore similarities to another months earlier that seemed to directly challenge Iran's Supreme Leader Ayatollah Ali Khamenei as the country's economy buckles under American sanctions.

Farsi-language satellite channels abroad published videos apparently shot by drivers in Isfahan, a major Iranian city, showing electronic billboards there reading: "Khamenei! Where is our gas?" Another said: "Free gas in Jamaran gas station," a reference to the home of the late Supreme Leader Ayatollah Ruhollah Khomeini.

The use of the number "64411" mirrored the attack in July targeting Iran's railroad system that also saw the number displayed. Israeli cybersecurity firm Check Point later attributed the train attack to a group of hackers that called themselves Indra, after the Hindu god of war.

Indra previously targeted firms in Syria, where President Bashar Assad has held onto power through Iran's intervention in his country's grinding war.

Abolhassan Firouzabadi, the secretary of the Supreme Council of Cyberspace, linked the attack to Iran's rail system assault in July in comments reported by IRNA. He also said it affected all of Iran's 4,300 gas stations nationwide.

"There is a possibility that the attack, like a previous one on the railway system, has been conducted from abroad," Firouzabadi said.

However, a former deputy telecommunications minister, Amir Nazemy, earlier wrote on Twitter that the "infrastructure of system of gas stations is an exclusive network and this sort of communications were not on the internet." That raises questions on whether someone inside of Iran with access to the system launched the cyberattack or otherwise facilitated it.

A previously unheard-of group claimed responsibility for the cyberattack hours afterward late Tuesday, in a message on the messaging app Telegram. It did not provide any evidence that it carried out the assault.

Cheap gasoline is practically considered a birthright in Iran, home to the world's fourth-largest crude oil reserves despite decades of economic woes.

Subsidies allow Iranian motorists to buy regular gasoline at 15,000 rials per liter. That's 5 cents a liter, or about 20 cents a gallon. After a monthly 60-liter quota, it costs 30,000 rials a liter. That's 10 cents a liter or 41 cents a gallon. Regular gasoline costs 89 cents a liter or $3.38 a gallon on average in the U.S., according to AAA.

In 2019, Iran faced days of mass protests across some 100 cities and towns over rising gasoline prices. Security forces arrested thousands and Amnesty International said it believes 304 people were killed in a government crackdown. Tuesday's cyberattack came in the same month in the Persian calendar as the gasoline protests in 2019.

The attack also came on the birthday of the late Shah Mohammad Reza Pahlavi who, stricken with cancer, fled the country in 1979 just before the Islamic Revolution.

Iran has faced a series of cyberattacks, including one that leaked video of abuses at its notorious Evin prison in August.

The country disconnected much of its government infrastructure from the internet after the Stuxnet computer virus — widely believed to be a joint U.S.-Israeli creation — disrupted thousands of Iranian centrifuges in the country's nuclear sites in the late 2000s.

Iran, long sanctioned by the West, faces difficulties in getting up-to-date hardware and software, often relying on Chinese-manufactured electronics or older systems no longer being patched by manufacturers. That would make it easier for a potential hacker to target. Pirated versions of Windows and other software are common across Iran.

Iran President Ebrahim Raisi
In this photo released by the official website of the office of the Iranian Presidency, President Ebrahim Raisi speaks during a cabinet meeting in Tehran, Iran, Wednesday, Oct. 27, 2021. Iranian Presidency Office via AP