US Entities Face Heightened Cyber Risk from Iran Retaliation amid War

Fitch Ratings warns US public finance, critical infrastructure face heightened cyber risk from Iran. Attacks may include DDoS, financial campaigns, and physical disruption as war escalates.

Fitch Ratings issued a warning Monday that US public finance institutions face heightened cyber risks amid the ongoing conflict with Iran, noting that Iranian state-backed actors, hacktivist groups, and independent attackers may increasingly target American government institutions and critical infrastructure.

"Risks include distributed denial-of-service attacks, financially motivated campaigns, and attacks that seek to cause physical disruption or destruction," Fitch said. "Attacks on infrastructure such as power or water systems can create downstream risks for other sectors." 

The warning follows the Feb. 28 joint U.S.-Israeli strikes on Iran, which killed more than 1,200 people including Supreme Leader Ayatollah Ali Khamenei. Iran has retaliated with drone and missile strikes targeting Israel and Gulf countries hosting U.S. military assets.

Pro-Iranian hacktivists have already claimed cyber-attacks on U.S. targets, including a Pennsylvania township where a group reportedly leaked personally identifiable information from Pennsbury Township. Iranian-linked groups have also been detected on networks of U.S. banks, airports, and software companies.

Iranian drone strikes damaged Amazon Web Services data centers in the UAE and Bahrain last week, causing structural damage, power disruptions, and digital service outages across banking and delivery apps in the region. Iranian state-linked media has since published lists of major U.S. tech firms including Google, Microsoft, Nvidia, and Oracle as potential targets, warning that "the scope of Iran's legitimate targets expands" as the conflict escalates.

The Canadian Centre for Cyber Security assesses that Iran will "very likely" use its cyber program to respond to U.S. operations, targeting critical infrastructure, conducting information operations, and harassing military personnel.