Iranian National Petroleum Products Distribution Company (NIOPDC) service stations ceased to operate today due to a cyberattack that affected the entire distribution network.
The incident generated a series of hacks on electronic highway billboards to display messages demanding an explanation or asking for fuel.
The NIOPDC network has more than 3,500 stations across the country and has supplied petroleum products for over 80 years.
Hackers echo previous attack
An investigation is examining the cause of the disruption and there is no public information on who did it yet, but Iran blames a hostile country.
One clue, which could also be a false lead, is a message displayed on machines indicating “cyberattack 64411”.
The memo refers to a cyberattack in July that disrupted Iranian rail service. The attackers also altered railway notice boards to indicate that hackers had delayed or canceled trains and posted the phone number of Supreme Leader Ali Khamenei’s office.
Research by cybersecurity company SentinelOne revealed that the Iranian train station system was targeted by malware specifically designed to delete data (file eraser) called Meteor that had never been seen before.
Today’s attack left Iranians waiting for hours for gas stations to open and found themselves without fuel.
According to media reports, the message “cyberattack 64411” appeared to customers trying to obtain subsidized fuel at 5 cents per liter or 20 cents per gallon using government issued cards.
As news spread that the NIOPDC distribution network was under attack, digital billboards in several cities in Iran began displaying messages saying “Khamenei! Where is our fuel? and “Free fuel at Jamaran station”.
Some local media reports initially said the disruption at the gas station was caused by a technical malfunction and then noted that the problem was due to a cyber attack.
According to BBC journalists Shayan Sardarizadeh and Kian sharifi, Iranian state television has confirmed reports of a cyberattack affecting gas stations and Iran’s Supreme Cyberspace Council believes the incident is state sponsored, although it is too early to tell which country is behind.