A bad Friday for cloud, aviation and rail produced no evidence of an attack — and plenty of people claiming one

On Friday 13 November a cluster of disruptions hit global cloud services, US aviation and European transport networks. Asia Pacific Security Magazine framed the question the next day as campaign versus coincidence and did not resolve it. The Spearpoint Dispatch situation report covering 13–14 November is more precise: on the FAA incident, officials said they had found no evidence of a cyberattack, investigators were examining router installation carried out during telecommunications modernisation, and no final technical cause had been established. Its own reading is that ageing, interconnected telecommunications can produce national-scale operational failure without a confirmed malicious intrusion. Separately, on 12 November ACI EUROPE, the European airport association, published a strategy on hybrid threats naming bomb threats, drone incursions and cyberattacks among growing challenges and arguing airports should be designated critical infrastructure. That is a lobbying position, not an incident report.

Against that absence of evidence sits a surplus of assertion. SocRadar’s “Iran–Israel/US War 2026” dashboard, updated 13 November and marked threat level CRITICAL as a Gulf Cooperation Council spillover assessment, aggregates attacker claims: a group styling itself “APT IRAN” claiming a month of access to Jordanian power plant control systems with a 75 percent reduction in output; the same group warning Iranian Starlink users that Israeli intelligence has compromised their terminals and announcing an imminent shutdown; a self-declared “Cyber Islamic Resistance” announcing a unified electronic operations room; NoName057(16) running DDoS against Israel, with Israel accounting for more than 70 percent of claims in the dataset. None is independently verified. A 75 percent cut at a national power plant would leave physical evidence; none is cited. The page also labels 13 November “Conflict Day 22” while dating the war’s start to 28 February 2026.

The Starlink item is the one worth keeping, not as a report of Israeli capability but as an information operation. Whether Israeli intelligence has compromised terminals inside Iran and whether an Iran-aligned actor wants Iranian users of circumvention infrastructure to believe it has are separate questions, and only the second is evidenced. Context matters: Al Jazeera reported on 14 October that Iran’s 90 million people had already endured two state-imposed global internet shutdowns in 2026 — three weeks during the January protests and 88 days at the start of the current war — while ACLED’s 22 October expert comment found access only partially restored, connectivity extremely slow, platforms still blocked and previously reliable VPNs no longer effective or affordable. Meanwhile the Wall Street Journal reported on 13 November, sourced to “cybersecurity officials and defense experts,” that suspected Iranian hackers are moving from theft toward physical effect against water systems, energy shipments and food storage.

Assessment: Three different mechanisms for converting uncertainty into alarm ran in parallel this week, and they are worth separating. A vendor dashboard monetises attacker braggadocio and cannot keep its own day count straight. A national cyber directorate asserts adversary intent at a conference without publishing artefacts — a claim by an interested official, not a demonstrated capability. And a regulatory process begins drafting disclosure rules for AI-assisted intrusions that have so far been characterised, not catalogued. The FAA episode is the control case: the one incident with real-world consequence produced an explicit official finding of no evidence of attack, and a suspected router. Readers in the Gulf should note that the CRITICAL spillover label was applied to them by a company selling threat intelligence.