This week’s Iran cyber headlines are mostly from February, April and August

The most-shared item on the beat right now is NBC News reporting from 2 September, published at 06:00 EDT, that Iranian hackers targeted US water systems along with telecommunications, energy and other infrastructure “in recent weeks” — sourced to four people with access to government information, with no on-the-record confirmation. The National ran a parallel piece the same day. Ten days on, no CISA advisory, utility disclosure or named official has followed. On top of that sits an aggregation layer: shattered.io, an SEO site rather than a reporting outlet, presents CISA advisory AA26-097A — an April 2026 document — bundled with the September NBC story as a single current threat picture, which is how a five-month-old advisory acquires a September stamp. The Meta takedown also still circulating as new is from an Axios exclusive of 27 August: an Iran-linked network using AI-generated content, reported as 4 Facebook accounts and 31 Instagram accounts, rated by Meta as “moderate” in reach.

The vendor and research layer is older still. Trellix’s “The Iranian Cyber Capability 2026” carries no visible publication date and internally references material only to March 2026; the Canadian Centre for Cyber Security’s Iranian bulletin is February 2026; Fortinet’s “Recent Cyber Attacks” page displayed a four-day-old stamp over content describing 2025 incidents. Citizen Lab has published nothing new this week — its telecom-signalling investigation “Bad Connection” is Report No. 192, dated 23 April 2026. The Israeli breach statistics attributed to National Cyber Directorate chief Yossi Karadi — two petabytes of Israeli data exposed, phishing up 35 percent, cyber influence attacks up 170 percent in 2025 — date from 20 February 2026. The Handala material in circulation is from February and March: Clalit healthcare records claimed on 25 February (”more than 10,000 patients,” the group’s own post, carried by Times of Israel; Clalit said it was investigating) and 50,000-plus documents claimed on 17 March from the email of Ilan Steiner, CFO of Israel’s National Security Council. All are group claims, not verified events.

Against that, the single dated, in-window, primary figure available is Internet Society Pulse’s count of 11 ongoing internet shutdowns worldwide as of 10 September. Pulse also logged an Iraqi government-ordered suspension on 1 September, 06:20 to 07:10 local time — fifty minutes, part of the recurring national school-exam series. UNESCO’s frequently quoted figure of at least 300 shutdowns across more than 54 countries comes from a statement of 2 July 2026, and the period it covers was not confirmed in this sweep, so it should not be charted. Two honest limits on our own side: the composition of those 11 shutdowns by country was not retrieved, and the Sahel — Mali, Burkina Faso, Niger, Guinea, Sudan, Chad — went entirely unchecked this cycle. We cannot say nothing happened there. We can only say we did not look.

Assessment: False freshness on this beat is not usually deception. It is the interaction of content-management systems that re-date evergreen pages, aggregators that bundle old advisories with new wire copy for search traffic, and readers who treat a hacktivist Telegram claim as an incident report. The result is a threat picture that appears to be accelerating when the underlying evidence is stationary. Recycled Iran material is particularly load-bearing because it services opposite readings — proof of escalating capability, or proof that anonymous sourcing never resolves. The discipline is simple and unglamorous: check whether the claim has a date, whether the date belongs to the event or the upload, and whether anyone has gone on the record since.