An Iranian hacking group claimed it caused the AT&T fiber outage that knocked out internet, TV and phone service for thousands of North Texas customers on Monday, Sept. 7, including in Wylie.

AT&T disputes the claim. The company said it has no evidence of a cyberattack and believes cable theft caused the disruption, WFAA reported Wednesday, Sept. 9.

The group, which calls itself APT IRAN, posted on its Telegram channel Tuesday, Sept. 8, claiming it attacked "telecommunications and other critical infrastructure in Texas." It also took credit for disrupting an unidentified water utility in the state.

AT&T's outage map on Sept. 7 showed severe fiber cable and equipment problems across multiple Dallas-area ZIP codes, with estimated repair times of eight to 10 hours. Downdetector data showed customer reports first spiked around 2:18 a.m., then climbed steadily through the late morning and into the afternoon.

Reports peaked at 5,990 shortly before 3 p.m. and dropped quickly. Service was mostly restored by 6 p.m.

More than 7,000 North Texas families lost service, WFAA reported. Garland, Plano, Rockwall, Rowlett and Wylie were among the affected areas.

Terry Snuggs, a Denton County clinical systems engineer who manages diagnostic imaging equipment for hospitals, told WFAA the outage crippled both his home fiber and cellular backup.

"We were just dead in the water," Snuggs said, adding that losing both connections left him unable to support the hospital systems he manages.

APT IRAN's track record

APT IRAN is closely linked to the Islamic Revolutionary Guard Corps (IRGC)-affiliated CyberAv3ngers, according to Threat Beat, a publication of the McCrary Institute for Cyber and Critical Infrastructure Security at Auburn University. The Threat Beat report was authored by Bridget Johnson and published Wednesday, Sept. 9.

The Center for Strategic and International Studies reported in August 2026 that CyberAv3ngers-linked actors had targeted water systems in at least 12 U.S. states. The most severe incident occurred in Georgia, where hackers shut down a pump station, causing a boil-water advisory.

APT IRAN previously claimed its late July attacks on dozens of water systems in Minnesota, Michigan, Georgia, New Jersey, South Dakota and Arkansas were meant as a warning. On Aug. 30, the group posted a threat to escalate, according to Threat Beat.

In April, the Cybersecurity and Infrastructure Security Agency (CISA), the FBI, the NSA and partner agencies issued an advisory warning that Iran-affiliated actors were exploiting internet-exposed industrial controllers used in water, energy and government systems.

AT&T reiterated on the record that it found no evidence to support APT IRAN's claim regarding the Sept. 7 outage. No federal agency has publicly confirmed or denied the group's claim.

APT IRAN has vowed to intensify attacks ahead of the 25th anniversary of the Sept. 11 attacks, on Friday, Sept. 11.