DOJ Charges 17 Iranians Over a Hacking-for-Hire Ring That Cost Universities $3.4 Billion.
- 17 Defendants Iranian nationals charged in a superseding federal indictment for an alleged hacking-for-hire campaign run on behalf of Iran's Islamic Revolutionary Guard Corps — DOJ press release 26-940, Aug. 18, 2026
- $3.4 Billion+ what U.S. universities collectively spent to procure and protect the academic data and intellectual property prosecutors say the defendants stole — DOJ press release 26-940
- 31+ Terabytes the volume of stolen data, taken from roughly 8,000 of more than 100,000 targeted professor email accounts at 144 U.S. and 178 foreign universities — DOJ press release 26-940
- $10 Million the State Department reward on offer for information leading to the location of five of the named defendants, all believed to remain in Iran — DOJ; IBTimes UK
The Justice Department unsealed a 14-count superseding indictment on August 18, 2026 charging 17 Iranian nationals with running a years-long, state-linked hacking-for-hire operation — the Mabna Institute — that prosecutors say stole more than 31 terabytes of academic data and intellectual property from universities around the world, much of it on behalf of Iran’s Islamic Revolutionary Guard Corps.
Nine of the 17 were first charged in a narrower 2018 indictment. This superseding case, assigned to U.S. District Judge Jesse M. Furman in the Southern District of New York, adds eight new defendants and lays out the campaign’s full scope: 144 U.S. universities, 178 foreign universities, 42 U.S. private companies, 11 foreign private companies, five U.S. federal or state agencies, and two nonprofits.
All 17 are believed to remain in Iran. “An indictment is merely an allegation,” DOJ’s release notes; all defendants are presumed innocent until proven guilty in a court of law.
Prosecutors say Gholamreza Rafatnejad and Ehsan Mohammadi founded the Mabna Institute in Tehran around 2013 to help Iranian universities and research organizations gain unauthorized access to scientific resources they couldn’t otherwise obtain. From 2013 through at least December 2017, the group ran a mass spearphishing and credential-theft campaign, compromising roughly 8,000 of more than 100,000 targeted professor email accounts, then sold stolen material through two Iran-based websites, Megapaper.ir and Gigapaper.ir.
One defendant, Behzad Mesri, is separately charged in a related case alleging that he hacked HBO’s systems in 2017, stole proprietary data including unaired “Game of Thrones” material, and attempted to extort the network for roughly $6 million in Bitcoin.
DOJ puts the cost to U.S. universities of procuring and protecting the stolen academic data and intellectual property at more than $3.4 billion. A separate set of password-spray intrusions tied to three of the defendants — Mojtaba Galekuhi, Keyvan Fayaz, and Saber Shahbazi Ballojeh — cost private-sector and government victims more than $20 million to investigate and remediate.
“The superseding indictment alleges that, at the behest of entities including the IRGC, these defendants hacked into universities and other research institutions worldwide, including the United States, stealing at least 31 terabytes of information and intellectual property of untold value. The National Security Division is committed to protecting the United States from such predators and will pursue those who perpetrate such crimes for as long as it takes to bring them to justice.”
John A. Eisenberg, Assistant Attorney General for National Security
“Today’s charges, which include eight additional defendants, reveal the broader network allegedly behind a sweeping, state-sponsored campaign to steal research and intellectual property from American universities, businesses, and government institutions,” said Jamie McDonald, U.S. Attorney for the Southern District of New York. “More than eight years after making the original indictment public, these charges make clear that the passage of time will not deter us from identifying and pursuing those who target the United States from abroad.”
17 Iranians charged with conducting a massive cyber theft campaign on behalf of the IRGC and other Iranian entities — a superseding indictment adding 8 new defendants to a case first brought in 2018.
FBI Cyber Division Assistant Director Brett Leatherman added: “These defendants allegedly built and profited from a sprawling hacking-for-hire operation that targeted the intellectual property of American and allied universities, companies, and government agencies for the benefit of the Iranian government. Today’s charges make clear to cyber adversaries everywhere: the FBI’s memory is long, and time will not blunt our resolve to pursue justice.”
The indictment lands amid heightened U.S.-Iran tension following military strikes earlier in 2026, and alongside a separate, uncharged federal investigation into a suspected Iran-linked cyberattack on water systems across several U.S. states this summer. FBI Assistant Director in Charge James C. Barnacle Jr. called the intrusions “a serious threat to our national security,” adding that the campaign “reflects a broader, organized effort to target U.S. institutions and global partners.”
DOJ unsealed a 14-count superseding indictment on August 18, 2026 charging 17 Iranian nationals in the Mabna Institute hacking-for-hire campaign, which prosecutors say stole 31+ terabytes of data from 144 U.S. and 178 foreign universities, costing American institutions more than $3.4 billion and generating a separate $20 million-plus remediation bill from related intrusions. Five defendants, including HBO-hack figure Behzad Mesri, carry a combined $10 million State Department reward. All 17 are believed to remain in Iran and are presumed innocent unless proven guilty in a U.S. court.
