Iran has already disrupted American water systems and hospitals, and is now threatening the country’s energy and telecommunications grids, according to an analysis published by Real Clear Wire and republished by The Gateway Pundit. The piece, written by retired Marine Corps Lt. Gen. Mike Groen and JINSA policy analyst Sarah Havdala, argues that Washington should treat Iranian cyber operations with the same seriousness as a kinetic strike.
Groen, who served as director of the Joint Artificial Intelligence Center, and Havdala, who works at the Jewish Institute for National Security of America, write that the two oceans Americans have long relied on for distance from Middle East conflicts offer little protection against digital intrusion. They call for a public signaling of a firm U.S. position, expanded intelligence-sharing with allies, and a hands-on cybersecurity initiative led by CISA.
The March Hospital Incident
Central to the authors’ case is an incident in March that they describe as likely “the most significant wartime cyberattack against the United States.” According to their account, the Handala Hack Team claimed to have wiped between 80,000 and 200,000 devices, an operation that prompted surgery delays at hospitals and caused panic among patients nationwide.
Weeks later, in July, several American towns issued water advisories after what the authors describe as a coordinated cyberattack on water facilities across the country. Cybersecurity experts quoted in the piece noted that the techniques used mirrored earlier Iranian hacking campaigns.
The authors attribute much of the activity to actors operating within the Islamic Revolutionary Guard Corps’ Cyber Economic Command and Iran’s Ministry of Intelligence, naming the Handala Hack Team specifically. They describe the group as having claimed responsibility for seizing personal information belonging to U.S. servicemembers stationed in the Middle East — including details tied to the F-35 fighter jet — and for hacking the email account of the FBI director.
Targets Beyond the U.S.
The analysis does not confine itself to American targets. It says Iran has also carried out cyberattacks against Israel and Arab partners including Jordan, Kuwait, Bahrain, Saudi Arabia, and the United Arab Emirates, part of what the authors characterize as an effort to pressure those governments to curtail their relationships with Washington. Handala has also claimed to have breached a facility and stolen roughly 430,000 classified documents, according to the piece.
The authors argue that Iran pairs these digital operations with conventional strikes to compound the damage, and note that U.S. forces in the region are simultaneously contending with Iranian missile and drone attacks. They frame cyber operations as one component of a broader campaign rather than a separate problem — a means by which Tehran can pressure Washington and reach American civilians without ever sending a soldier across an ocean.
The article points to recent moves by the Trump administration to expand U.S. jurisdiction over foreign cybercriminals, but contends that such steps have not deterred Iranian groups. Threats to water, energy, and telecommunications infrastructure, the authors write, suggest that Iranian cyber operators feel empowered to keep going.
Policy Prescriptions
Groen and Havdala outline a three-part response. First, they argue that U.S. officials should publicly state that any deal with Tehran — including one ending active hostilities — depends on the regime halting cyberattacks on American and partner infrastructure. They acknowledge that such a condition could invite loophole-seeking but describe it as a necessary starting point.
Second, they urge the intelligence community and foreign partners to share common tactics, techniques, and procedures used by Iranian cybercriminals, and to make those identifying features known to the public so that organizations and individuals can recognize and thwart attacks before they succeed.
Third, they call on the Cybersecurity and Critical Infrastructure Security Agency to lead a nationwide educational initiative alongside state, local, and tribal governments, as well as major telecommunications, water, and energy stakeholders. The program, as they describe it, would focus on identifying zero-day vulnerabilities and supplying organizations with the tools to fix them. Under their proposal, any organization CISA determines plays a direct role in operating critical infrastructure would have to meet a set of cybersecurity conditions and undergo annual compliance reviews.
Treating Cyber Like Kinetic
The authors close by arguing that Iran’s cyber warfare has penetrated daily American life while disrupting military operations overseas, and that it cannot be separated from Tehran’s actions in the Strait of Hormuz or its missile barrages. Their central recommendation is a doctrinal shift: Washington, they write, should treat any cyberattack targeting U.S. military assets, civilians, or international partners the way it would treat a kinetic strike — holding Iran accountable while bolstering defenses at home and coordinating closely with allies abroad.
The piece was originally published by Real Clear Wire. Groen is a retired Marine Corps lieutenant general and former director of the Joint Artificial Intelligence Center who participated in JINSA’s 2023 Generals and Admirals Program; Havdala is a policy analyst at JINSA.
Source: www.thegatewaypundit.com — https://www.thegatewaypundit.com/2026/10/iranian-cyber-operations/