When Your Board Can't Tell an Attack from an Accident

On Labor Day, AT&T lost service across the Dallas-Fort Worth metroplex. Over 7,000 families went dark — no internet, no television, no phone. DownDetector peaked near 5,900 reports in a single hour. AT&T called it a fiber equipment issue, likely attempted cable theft.

The next day, an Iranian hacking group called APT Iran posted on Telegram that it had done it on purpose. The group — linked to the Islamic Revolutionary Guard Corps' Cyber-Electronic Command and tracked by the U.S. government under the name CyberAv3ngers — claimed it had hit AT&T infrastructure across Houston, Dallas, Austin, and San Antonio. It also claimed to have breached a Texas water utility. And it promised more attacks before September 11.

AT&T said there was no evidence to support the claim. As of this writing, no independent source has confirmed the group actually caused the outage.

So here is the question that should keep every board member awake: Does your organization know the difference between an outage and an attack?

The Attribution Gap Is a Business Problem

Most boardrooms treat cyber incidents as binary — either we were attacked or we weren't. The AT&T episode exposes how dangerous that framing is. What actually happened in Dallas sits in a gray zone that enterprises deal with far more often than they admit: an operational disruption with no clear attribution, dueling narratives, and a ticking clock on public communication.

In Cyber Risk Is Business Risk, I call this the attribution gap, and it feeds directly into the Three Questions every board should be asking about any cyber event: What happened? How bad is it? What are we doing about it? When you cannot answer the first question with confidence — when "cable theft" and "nation-state attack" are both on the table — the second and third answers become guesses dressed up as strategy.

AT&T handled its communications quickly. But imagine a mid-market company facing the same ambiguity. A regional hospital network loses connectivity. A logistics provider's dispatch system drops offline. The CEO gets a call from a reporter asking whether it was a cyberattack. What do you say when you genuinely don't know?

Iran's Infrastructure Campaign Is Real

Even if the AT&T claim turns out to be opportunistic — a hacktivist group taking credit for someone else's cable theft — the underlying threat is not theoretical. On April 7, 2026, the FBI, CISA, NSA, EPA, Department of Energy, and U.S. Cyber Command issued joint advisory AA26-097A warning that Iranian-affiliated actors are actively exploiting internet-exposed programmable logic controllers across U.S. critical infrastructure. The advisory confirmed operational disruption and financial loss at multiple victim organizations in government, water and wastewater, and energy sectors.

CISA updated that advisory on July 22, expanding the scope to include Schneider Electric and Siemens PLCs alongside the originally named Rockwell Automation controllers. In 2024, the U.S. Treasury sanctioned six IRGC-CEC officials tied to the CyberAv3ngers campaign. This is not a theoretical risk briefing. These are named individuals, named equipment, and confirmed compromises.

The AT&T situation matters not because we know Iran caused it, but because a credible threat actor with documented capability claimed it did — and the company's initial public response was "cable theft." For boards watching from the outside, that gap between claim and response is where reputation risk lives.

What to Ask Your CISO This Week

If the AT&T episode tells us anything, it is that the line between physical disruption and cyber disruption is dissolving. Cable theft and a cyberattack can look identical from the outside. Your customers will not wait for a forensic investigation to form their opinion.

Here are four questions worth raising at your next board meeting or security briefing:

Can we distinguish an attack from an operational failure in real time? If your monitoring stack cannot tell the difference between a cut fiber and a compromised network element within the first hour, you have an attribution gap. That gap becomes a communication gap, and then a credibility gap.

Do we have a pre-drafted holding statement for ambiguous incidents? AT&T moved quickly, but many organizations freeze when they cannot confirm what happened. A statement that acknowledges disruption without prematurely ruling out malicious activity is not waffling — it is accurate.

Are we tracking nation-state advisories for our sector? CISA advisory AA26-097A names specific PLC models and sectors. If your operations use Rockwell, Schneider Electric, or Siemens controllers, your security team should have already mapped your exposure. If they haven't, that is a board-level finding.

What is our dependency on any single telecommunications provider? Over 7,000 families lost all connectivity because of one provider's fiber infrastructure in one metro area. If your enterprise relies on a single carrier for voice, data, and backup, you are one disputed outage away from the same conversation AT&T is having now.

The Real Risk Is Ambiguity

The AT&T story will likely fade from the headlines. Cable theft or cyberattack, the service came back, and most customers moved on. But the pattern it exposed — a nation-state actor with documented capabilities claiming credit for a domestic infrastructure failure while the operator points to physical damage — that pattern is going to repeat. And next time, the target might be a company with less capacity to absorb the reputational hit.

Boards that wait for certainty before acting on cyber risk are boards that act too late. The Three Questions framework exists precisely for moments like this: you do not need perfect attribution to start making better decisions about resilience, communication, and oversight.

The question is not whether Iran actually knocked out AT&T's fiber in Dallas. The question is whether your organization could tell the difference if it happened to you.