Iranian hackers attacked college professors, US agencies and companies: Justice Department

Key Points
  • Nine Iranians are charged in a wide-ranging scheme to hack and steal electronic data from universities, private corporations and U.S. government entities.
  • The data breach could cost universities billions of dollars, the DOJ says.
Justice Department announces major cyber-crime enforcement
Justice Department announces major cyber-crime enforcement

Nine Iranians were charged Friday by the Justice Department in a wide-ranging scheme to hack and steal electronic data from universities, private corporations and U.S. government entities to benefit the government of Iran.

The Iranians were indicted on seven counts accusing them of identity theft and conspiracy to commit computer intrusions.

The nine allegedly accessed the computer systems of U.S. universities through duplicitous electronic contacts, a scheme known as phishing. They targeted more than 100,000 professor email accounts at 144 American universities through the spearphishing campaign, the indictment said.

The activity, which had allegedly been conducted since 2013, could cost universities $3.4 billion.

"That type of criminal activity does not just cause economic harm," Deputy Attorney General Rod Rosenstein said. "It also threatens our national security. Identifying and prosecuting computer hackers is a priority for the Department of Justice."

The nine defendants were accused of being affiliated with the so-called Mabna Institute and acted at the behest of one of Iran's intelligence gathering entities.

They also targeted and compromised at least 36 U.S.-based private companies and at least 11 companies based in Germany, Italy, Switzerland, Sweden and the United Kingdom, proescutors said.

And the indictment counts at least five government agencies, including the Labor Department, the Federal Energy Regulatory Commission and the United Nations, among the victims of the hacking campaign.

The nine are at large, the Justice Department said.

Rod Rosenstein, deputy attorney general, speaks during a news conference at the Department of Justice in Washington, D.C., on Friday, Feb. 16, 2018.
Andrew Harrer | Bloomberg | Getty Images

In addition to the hacks on U.S. entities, accounts from 176 universities outside the U.S. were targeted, authorities said.

The data breaches successfully compromised roughly 7,998 accounts or more worldwide, and at least 3,768 belonged to professors at U.S. universities, investigators said.

"Academic institutions are prime targets for foreign cybercriminals. Universities can thrive as marketplaces of ideas and engines of research and development only if their work is protected from theft," Rosenstein said.

The Treasury Department's Office of Foreign Assets Control issued sanctions against the Iranians on Friday.

Rosenstein announced the indictments alongside several senior officials — including David Bowdich, who succeeded Andrew McCabe as the FBI's acting deputy director following McCabe's firing last week.

Read the full indictment: