Iranian Motorists Hit With Cyberattack at Filling Stations

CAIRO — A cyberattack disrupted gasoline stations across Iran on Tuesday, several state-run Iranian news agencies reported, leaving the authorities and fuel distributors scrambling to restore service.

The attack, which led to long lines outside gas stations for much of the day, came shortly before the anniversary of the November 2019 antigovernment protests that erupted over fuel price increases.

The Iranian authorities, who have been embarrassed repeatedly in the past by cyberattacks that they blamed on the United States and Israel, said they were investigating the episode, state media reported.

“Targeted operations have been carried out on gas stations, and the relevant officials are solving the problem,” Fereydoun Hassanvand, the head of the energy commission of Iran’s Parliament, told reporters on Tuesday, the semiofficial news agency ISNA reported.

Officials were quoted by state-run news agencies as saying that only the mechanism for buying gas with subsidized fuel cards had been affected, and that drivers could still refuel at a higher, unsubsidized rate.

But most Iranians, squeezed by an economy that has suffered under mismanagement, corruption and American sanctions, depend on subsidized gas.

Not only the pumps may have been hacked. Photographs on social media showed digital billboards in Tehran, the capital, and Isfahan, another major Iranian city, displaying the message, “Khamenei, where is our fuel?” The question appeared to refer to Ayatollah Ali Khamenei, Iran’s supreme leader, perhaps suggesting a political motivation for the attack.

ISNA reported earlier Tuesday that other billboards in Isfahan had displayed the words “Free fuel in Jamaran gas station,” an apparent reference to the Tehran neighborhood that was home to Ayatollah Ruhollah Khomeini, Iran’s original supreme leader. It also reported that drivers trying to pay for fuel got error messages reading “cyberattack 64411,” the same number as a hotline in Mr. Khamenei’s office.

Within minutes, however, ISNA’s coverage of the hacked billboards had disappeared, a not-uncommon occurrence that sometimes indicates that the authorities have disapproved of a report. An hour later, ISNA claimed the earlier report had been written by hackers.

By Tuesday evening, the Iranian authorities had not blamed anyone for the attack, nor had anyone claimed responsibility.

Iran has been the target of a series of cyberattacks over recent years, some directed at its nuclear program, including an American and Israeli campaign against one of the country’s uranium enrichment facilities between 2009 and 2010. Others, like the one that caused havoc in Iran’s railway system in July, are aimed at its infrastructure.

The July attack stood out because researchers concluded it had been carried out not by a rival government but by an independent group called Indra, named after the Hindu god of war, which appears to be opposed to the Iranian government. In that attack, too, hacked digital messages bore the number 64411.