Iran's president on Wednesday confirmed that a sweeping cyberattack had disrupted gas stations across the country, blaming the action on “people angry by creating disorder and disruption.”
Long lines continued to form outside stations following the takedown, which disabled government-issued cards that many rely on to buy subsidized fuel.
President Ebrahim Raisi said the incident showed the need for "readiness in the field of cyberwar."
The Iranian leader, who took office in August, did not blame any group or country in particular for the attack. However, his comments suggested that he believed anti-Iranian forces may have been behind the incident.
The chaos caused by the cyberattack came just weeks before the second anniversary of deadly protests over fuel price hikes.
Download the NBC News app for breaking news and politics
Motorists looking to buy subsidized fuel using government-issued electronic cards were instead met with cryptic messages on gas machines that read: “Cyberattack 64411,” the semiofficial news agency ISNA reported on Tuesday.
The digits, 64411, also appear to be the number for a phone line connected to Supreme Leader Ayatollah Ali Khamenei’s office.
So far, no group has publicly claimed responsibility for a cyberattack.
Nearly half of gas stations were back to being fully operational once manual settings were activated, according to Reuters, and the rest were expected to be brought back online on Wednesday.
In a message sent out to residents on Tuesday evening, Iran's oil ministry said that "the technical problem of the fuel smart system will be resolved soon."
The oil ministry also sought to address "rumors of gasoline price increases," saying they are "not true."
The ministry did not immediately respond to a request for comment from NBC News.
Neither did the National Iranian Oil Refining and Distribution Company nor the Iranian embassy in London.
The disruptions come weeks before the anniversary of deadly protests that were prompted by a rise in fuel prices in November 2019.
They also came as videos posted on social media claimed to show electronic street signs hacked to read: "Khamenei, where is our gasoline?" appearing to address Supreme Leader Ayatollah Ali Khamenei.
NBC News has been unable to independently verify the videos, but Iran's semiofficial news agency Mehr reported that some signs had been hacked.
International sanctions, as well as Iran’s political isolation, means much of the country’s digital infrastructure relies on older, unpatched versions of Western software, said Amir Rashidi, an Iran-born cybersecurity expert and the director of digital rights at the Miaan Group, a nonprofit that advocates for online rights for marginalized groups.
That leaves the country particularly vulnerable to hackers, Rashidi said.
John Hultquist, the vice president of threat intelligence at the cybersecurity firm Mandiant, said that there wasn’t yet enough technical data to prove who was behind the attacks.
“I think it’s too soon to attribute this,” Hultquist said. However, he said that Iran could retaliate if they feel a certain country is responsible for the attack."
"Information operations means perception is reality,” he said.
Iran has said it is on alert for online attacks, which it has blamed on Israel and the U.S. in the past.
Meanwhile, Iran has faced accusations from the U.S. and other Western powers of trying to hack into their own networks.
In April, Iran blamed Israel for an attack on its underground Natanz nuclear facility that saw centrifuges used to enrich uranium damaged.
The Trump administration was reported in 2019 to have carried out a cyberattack campaign against Iran following attacks on Saudi Arabia's oil facilities.
At the time, Iran maintained that the U.S.'s efforts had not been successful.
State Department spokesperson Ned Price declined to comment on the apparent cyberattack.