Iranian hacker extradited to the US over a $3.4bn data raid

Montenegro has extradited an Iranian-Turkish dual national to the United States over a hacking campaign that stretched back more than a decade, police in the Balkan country said. Amir Barati, 40, was arrested in June in the coastal town of Kotor at the request of US authorities including the FBI, and is expected to face wire and computer fraud charges in the Southern District of New York.

What prosecutors allege

The Justice Department says Barati is one of 17 members of the Mabna Institute, an Iran-based company charged in a 14-count superseding indictment unsealed on 18 August 2026. Since at least 2013, prosecutors allege, the group broke into 144 US universities, 178 foreign universities, at least 42 US companies, at least 11 foreign companies, at least five US federal and state agencies and at least two non-governmental organisations, stealing more than 31 terabytes of academic data and intellectual property along with the email accounts of staff at the targeted companies and agencies. Much of the work was carried out on behalf of Iran's Islamic Revolutionary Guard Corps, according to the indictment.

A $3.4 billion bill for stolen research

The indictment covers more than 8,000 email accounts belonging to professors in the US, Europe and elsewhere, and puts the cost of procuring and accessing the targeted academic data at about $3.4 billion. Barati is accused of tracking the progress of the university intrusions and building targeting lists for private-sector victims, which prosecutors say included 11 technology firms and two defence contractors. Among the other alleged victims named by the Justice Department are the Department of Labor, the Federal Energy Regulatory Commission and the United Nations. The case is assigned to US District Judge Jesse M. Furman, and nine of the 17 defendants were first charged in a seven-count indictment announced in March 2018.

Why the extradition matters

Accused Iranian hackers rarely end up in a US courtroom, so the handover is a notable win for American law enforcement. Montenegro's police described Barati as a high-profile target sought over cybercrime and organised crime, and said his arrest followed an exchange of operational and intelligence information between Montenegrin and US agencies. He faces several charges in New York, including conspiracy to commit computer fraud, hacking and identity theft. A spokesperson for the Southern District of New York declined to comment on the extradition.

Our opinion

The Mabna case is unusual not for its scale but for its patience. The first charges were announced in 2018, and the Justice Department has spent eight years adding defendants and waiting for one of them to travel somewhere with an extradition treaty. That is a slow, unglamorous kind of deterrence, and it is precisely the kind that state-sponsored hacking outfits bet never arrives. Barati's arrival in New York will not stop Iran's cyber operations, which Washington says have been aimed at water systems, fuel infrastructure and medical manufacturers during the current conflict. It does, however, make a point that extradition paperwork outlasts political attention. If the case reaches trial, the detail worth watching is not the terabytes but the targeting lists, because those are what turn stolen research into a business model.

Photo by Markus Spiske on Pexels