Telecommunications giant AT&T has firmly dismissed claims made by an Iranian-linked hacking collective that claimed responsibility for a substantial network outage that left thousands of customers across Texas without internet connectivity on Monday. While the cyber actors alleged that their digital offensive brought down the carrier's systems, company officials maintained that physical infrastructure tampering was the true source of the service collapse.
The claims originated from a group operating under the moniker APT IRAN, which is tied to the Islamic Revolutionary Guard Corps-affiliated cyber outfit known as CyberAv3nger. The group published a statement on the messaging platform Telegram on Tuesday, asserting that it had successfully executed a cyber strike against telecommunications infrastructure as well as an undisclosed Texas water utility.
The hacker group's claims were initially reported by Threat Beat, a specialized cybersecurity news publication affiliated with the McCrary Institute for Cyber and Critical Infrastructure Security at Auburn University. According to the cybersecurity outlet, the announcement was framed by the group as part of an expanding digital campaign directed at critical American utility systems.
Threat Beat noted that the Iranian entity had previously broadcast warnings in late August, cautioning that it intended to unleash "unexpected and critical events." Those prior warnings specifically singled out key American operational sectors, focusing primarily on the telecommunications, energy, and water industries as potential targets for hostile disruption.
In addition to its warnings, the collective has recently claimed credit for a succession of digital incursions targeting municipal water infrastructure throughout the United States. Following those incidents, the group issued further threats declaring an intention to intensify hostile actions against American critical infrastructure ahead of Sept. 11.
Despite the aggressive posture and public declarations from the hacking group, AT&T conducted internal evaluations and found no indications that unauthorized digital penetration or foreign cyber warfare had compromised its networks. Company representatives moved quickly to counter the narrative being circulated online by foreign actors.
An AT&T spokesperson confirmed on Wednesday that the organization uncovered no proof linking the Monday disruption to any form of cyber offensive. The company stressed that forensic and technical assessments instead pointed to a much more routine and localized physical crime rather than a sophisticated international hack.
According to AT&T's technical assessment, the widespread loss of connectivity was triggered by an attempted physical cable theft. Such incidents involving attempts to strip or steal copper and fiber communication lines frequently sever critical transmission pathways, resulting in sudden and widespread localized network failures.
The disruption initially registered during the early morning hours on Monday. Data collected by the outage tracking platform DownDetector indicated that service complaints first began to trickle in at approximately 2:18 a.m., hinting at an initial overnight breach of network continuity.
While the early morning hours saw a manageable number of reports, a secondary and much more intense wave of outage notifications surged during Monday afternoon. The monitoring service logged thousands of complaints as residents throughout Texas encountered sudden connection drops, with major outage clusters identified across Houston, Spring, Dallas, Fort Worth, and Austin.
By late afternoon, the scale of the interruption prompted AT&T to address the public directly regarding the situation. At approximately 4 p.m. on Monday, the carrier posted an alert on the social media platform X, categorizing the disruption as a "red alert" and formally acknowledging that more than 7,000 households were experiencing service failures.
In its public disclosure, AT&T explained that technicians were actively working to resolve a major fiber outage centered in the Dallas metropolitan area. The company expressed its awareness of how crucial dependable broadband is for residential customers and offered an apology for the initial delay in providing timely updates to affected subscribers.
Repair crews worked to repair the physical damage caused by the attempted theft, and service was subsequently restored to impacted communities. By Wednesday, AT&T reported that broad internet connectivity had returned to full functionality across the Dallas area and neighboring regions.
An AT&T spokesperson noted that home and business internet services across Dallas and adjacent regions were once again operating normally. The representative emphasized that network engineers would continue to monitor system traffic and analyze operational data to ensure network resilience and prevent recurring interruptions.
The incident underscores the growing tendency of foreign hacking collectives to opportunistically claim credit for real-world infrastructure failures to amplify their perceived reach, even when local disruptions stem entirely from physical damage and attempted line theft.
(0)