By Emran | 2025-04-30

Hackers have exposed the sensitive personal information of nearly 30 million subscribers to the Islamic Republic's largest telecommunications company, revealing deep vulnerabilities in the nation's digital infrastructure.

In addition to sparking fears about the exposure of personal data, which the hackers threatened to sell, the breach has raised alarm about state surveillance.

The ShadowBits hacker group on April 11 said it had infiltrated the servers of Mobile Communication Company of Iran (MCI), gaining access to customers' full names, birth details, national ID numbers and postal addresses.

Initial coverage of the breach by Iranian technology news website Digiato was swiftly removed, with ShadowBits claiming this was done under pressure from Iranian intelligence agencies.

"Through direct contact with the perpetrators of this attack, we have confirmed the authenticity of this security breach," self-described cyber espionage investigator Nariman Gharib said in an April 14 post on X.

"The compromised database, which was on Oracle, was not encrypted at all."

Iranian telecom companies maintain close ties with intelligence agencies and telecommunications data is often used to monitor Iranian citizens, Gharib wrote on his blog.

A pattern of security failures

The MCI data breach adds to a growing list of cyber incidents targeting Iranian infrastructure that have exposed critical weaknesses in Tehran's approach to data protection.

Among them, the hacking of MCI's website in October 2022, the exposure of millions of mobile subscriber records in 2016 and 2020, and the sale of 160 million customer records from 23 insurance companies in January 2024.

"The physical safety and personal data of Iranians are not a priority for the Islamic Republic," Mashhad resident Morteza Javadi, 35, told Pishtaz.

"Instead of focusing on citizen security, the regime spends billions of dollars of public funds to support proxy groups in the region to advance its political agenda," Javadi said, reflecting a sentiment shared by many Iranians.

"While other governments around the world prioritize protecting their citizens and addressing their problems, the Islamic Republic has ignored the demands and needs of the Iranian people," he said.

The scale of the breach is particularly concerning given MCI's central role in Iran's telecommunications infrastructure.

With over 100 million subscribers relying on its services for everything from phone calls to banking transactions, the exposure leaves millions vulnerable to phishing scams, financial fraud and identity theft, experts warn.

"This incident sends a very clear message to all Iranians: that the country's telecom networks lack proper immunity, and people's personal information is easily exposed to risk," said Mashhad-based cybersecurity expert Mehdi Alipour.

"These networks can no longer be trusted," he told Pishtaz.