A hacker group has claimed to have infiltrated the customer database of Mobile Communications of Iran (commonly known as Hamrah Aval), the largest mobile phone operator in Iran, gaining access to the personal information of 30 million of its users.
According to reports, the hacked data includes customers’ personal information such as full names, dates and places of birth, national identification numbers, birth certificate numbers, and complete postal addresses.
The hacker group, named ShadowBits, also announced that it has obtained information about Hamrah Aval’s employees.
As of now, neither Hamrah Aval nor any state-affiliated media outlets in Iran have issued any statements or reports on the matter.
The Iranian technology news website Digiato initially reported the breach but later removed the article from its platform.
ShadowBits shared a screenshot of the deleted Digiato article on their Telegram channel, claiming that “pressure from intelligence agencies” led to the article’s removal.
Telecommunication companies in Iran, including Hamrah Aval, maintain close ties with intelligence and security agencies, and telecom data is often used for surveillance of citizens.
These companies have reportedly provided means for security services to intercept two-factor SMS authentication codes without the phone owner’s knowledge, allowing them to secretly access citizens’ online accounts.
Iranian Regime Presidency Servers Taken Over By Dissidents, Exposing Regime Vulnerabilities
This is not the first time that Mobile Communications of Iran has been targeted in cyberattacks.
In October 2022, during a wave of cyberattacks on websites affiliated with Iran’s regime, Hamrah Aval’s website was hacked and customer billing information was altered to show zero charges.
In July 2016, Iranian media reported that “information pertaining to 20 million users” of a mobile operator had been hacked.
In June 2020, MAHER (Iran’s Computer Emergency Response Team Coordination Center), which is affiliated with the Ministry of Information and Communications Technology, confirmed the leak of data for over five million users of Rightel, another Iranian mobile operator.
In January 2024, anonymous hackers put up for sale a dataset of 160 million customer records from 23 Iranian insurance companies on the internet.
Leakfa, an Iranian data breach tracking platform, confirmed the authenticity of the leaked data and stated that it was obtained through a cyber-infiltration of the infrastructure of “Fanavaran Etela’at Khebreh” (a technology service provider), which occurred shortly before.
At the time, none of Iran’s official institutions—including the Security Office of the Central Insurance Organization and the regime’s cyber police—published any official report on how the hackers accessed the private data of citizens.
This attack has raised serious concerns about privacy and data security for Iranian citizens.
The structure of the leaked dataset indicates that the breach revealed both current and historical customer records, likely affecting both current and former subscribers of Hamrah Aval.
