Cyber Incident Victim: Evin prison
Date:
Aug 2021
Location:
Iran
Summary
A hacktivist group breached the internal CCTV system of a Tehran prison facility known for housing political detainees, leaking videos depicting extensive inmate abuse including beatings by guards, suicide attempts, and unconscious prisoners being dragged. The footage, timestamped to recent periods, was disseminated to international media outlets and showcased the hackers' takeover of the prison's control room systems. While another Iranian hacktivist group amplified the leaks, officials did not dispute the authenticity of the abuses; the Attorney-General and head of the prisons organization both announced formal investigations into the incidents. The facility had previously been cited in reports for systemic human rights violations against detainees.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
On August 24, 2021, the hacktivist group Adalat Ali (Ali's Justice) publicly leaked CCTV footage obtained through a breach of Evin prison's internal security systems in Tehran. The group had compromised the prison's CCTV network months prior to the disclosure, though Iranian authorities did not acknowledge the intrusion until the leak occurred. Videos timestamped between 2020 and 2021 depicted guards physically assaulting inmates, suicide attempts by prisoners, and unconscious detainees being dragged through corridors. Adalat Ali shared evidence of their operational success through a video showing their takeover of prison control room computers, including system reboots and a displayed message referencing the hack. The group disseminated the materials on August 22 to journalists from Radio Farda, Iran International, and the Associated Press. Fellow Iranian hacktivist collective Tapandegan (Palpitations) amplified dissemination of the footage but clarified they were not operationally involved, attributing the breach solely to Adalat Ali.
Iranian judicial authorities did not dispute the authenticity of the leaked abuse footage following its publication. Attorney-General Mohammad Jafar Montazeri announced a formal investigation via Twitter, while Mohammad Mehdi Haj-Mohammadi, head of Iran's prison administration, accepted institutional responsibility for the documented mistreatment and initiated a parallel inquiry. Evin Prison had previously faced international condemnation for systemic human rights violations against political detainees of both genders, though the CCTV breach provided unprecedented visual evidence of these conditions. The incident marked one of the first documented cases where hacktivists successfully exposed prison abuses through direct cyber intrusion, bypassing government censorship mechanisms that had historically suppressed such disclosures.