Payment Giant Verifone Disputes Iranian Hacking Group Hit

A self-proclaimed hacktivist group widely suspected of being a front for Iranian intelligence claimed Wednesday to have hacked New York City-based payment device maker Verifone, saying it disrupted the organization’s Israeli office and stole data.

See Also: Experts Offer Insights from Theoretical to the Realities of AI-enabled Cybercrime

Verifone disputed the assertion. “Verifone has found no evidence of any incident related to this claim and has no service disruption to our clients,” it said in a statement.

The hacking claim comes from Handala, a group that cybersecurity experts say appears to be run by Iran’s Ministry of Intelligence, in part to execute pro-Tehran psychological operations.

“This sophisticated operation has caused widespread disruption in payment systems and terminals, and all related transaction and financial data have been extracted,” Handala claimed in a post to social platform X, publishing separately claimed screenshots from the intrusion.

Not all of the group’s claims are necessarily spurious. Handala claimed credit for disrupting American medical device giant Stryker, wiping 200,000 systems across 79 countries. The company confirmed the attack, and said it’s restoring systems (see: Medtech Firm Stryker Disrupted by Pro-Iran Hackers).

Handala on social media network X asserted the Verifone hack was retaliation for airstrikes targeting Iranian banking infrastructure. Two of Iran’s biggest state-owned banks suspended services Tuesday, leaving customers unable to withdraw funds or contact customer support. While some rumors suggested the outage traced to a Western cyberattack, others suggested it traced to a missile striking a Tehran-based data center.

The Islamic Revolutionary Guard Corps said Wednesday that any banking infrastructure in the Middle East with ties to the United States or Israel are targets for missile or drone attacks, and urged civilians to stay away from any such facility. The IRGC also announced that any regional facilities tied to multiple American technology giants, including Amazon, Google and Microsoft, were now on its list of military targets. The United States and Israel launched a campaign of aerial bombardment against Iran on Feb. 28 in an effort the U.S. dubs “Operation Epic Fury” (see:: US Says Cyber Operations Underpinned Assault on Iran).

Researchers at Check Point Security said in a Tuesday report that Israel-targeting Handala is one of the hacktivist personas run by an Iranian intelligence ministry-linked group it tracks as Void Manticore, which also runs a persona called “Homeland Justice” that targets Albania.

“While the group is most commonly associated with ‘hack and leak’ operations and disruptive attacks, particularly wiper operations,” the group has also been tied to attacks involving Rhadamanthys, which is a popular strain of information-stealing malware sold on darknet forums, it said (see: Cyberattack Tempo Ratchets Up in Israel).

Handala said its attack against Stryker was reprisal for a U.S. missile striking a girls’ school in the south of the country on Feb. 28, when the U.S.-Israeli air attacks began, that killed at least 175 people, many of them children.

How long ago Handala may have gained access to either Stryker or Verifone – if it did – isn’t clear.

“Their MO is break in, lay low for months,” exfiltrate sensitive data “and then delete everything including org backups,” said British cybersecurity expert Kevin Beaumont in a Wednesday post to social platform Mastodon.

“They pivot to domain admin early and then sit on access for later. They live off land and live off org IT documentation,” he said.

The disruptions so far unleashed or claimed by Handala are notable for their escalatory nature, but also for what attackers don’t appear to have done, said Ian Thornton-Trump, CISO at cybersecurity firm Inversion6.

In particular, if Verifone’s systems were wiped and payment infrastructure disrupted worldwide, that would likely provoke an escalatory response from U.S. President Donald Trump, given the hit on critical national infrastructure.

Instead, the group appears to be toeing certain red lines. “So far all indications are it was a data theft, so Iran’s proxies get one in the win column: infiltrate national critical infrastructure, embarrass and cause pain for the company and the USA but avoid substantial consequences,” he told Information Security Media Group.

“It seems like Iran’s proxies are being very careful and disciplined in their operations – one may dare say professional,” he said.

Stryker Restoring Systems

Stryker, which reported 2024 sales of $22.6 billion and counts over 53,000 employees worldwide, early on Thursday said it was “continuing to resolve the disruption impacting our global network, resulting from the cyberattack,” that its ordering system is currently offline and that it’s safe to communicate by email or phone with any of its employees.

“There is no indication of malware or ransomware and we believe the situation is contained to our internal Microsoft environment only,” it said. The company added that its products “are fully safe to use.”

Hacktivist Noise Escalates

A number of hacktivist groups or personas have become much noisier since the start of the conflict, announcing distributed-denial-of-service targets and claim hack-and-leak victims tied to the campaign. Among others, these groups have included DieNet, Keymous+ and Russia-linked NoName057(16), said Rapid7.

As with anything involving hacktivists – personas or otherwise – many of the groups’ claims are outright lies, designed to garner headlines and have a psychological impact on targets.

“Many of the breach claims circulating on Telegram and darkweb forums are exaggerated or outright fake. Threat actors, especially on the hacktivist side, are recycling old leaked datasets, overstating their access, and running what amount to psychological operations aimed at causing panic and reputational damage,” Rapid7 said.

“That said, where state-directed actors are involved, legitimate data theft is a real concern, and there is a strong likelihood that stolen material will be weaponized publicly and quickly,” it said.