Amir Barati Extradited to US in Alleged $3.4 Billion Cyber Theft Case

Important: The criminal charges discussed in this article are allegations. Amir Barati is presumed innocent unless and until proven guilty in court.

Montenegro has extradited Amir Barati, an Iranian-Turkish dual national, to the United States to face federal charges tied to an alleged cyber-theft campaign run through the Iran-based Mabna Institute.

The U.S. Department of Justice says Barati is one of 17 defendants in a superseding indictment accusing Mabna Institute members of cyber intrusions against universities, private companies, government agencies and other organizations. The alleged campaign began around 2013 and involved the theft of academic research, intellectual property and email credentials.

Prosecutors allege that about 8,000 professor email accounts were compromised across U.S. and foreign universities, and that 144 U.S. universities were targeted. The indictment also says U.S. universities spent more than approximately $3.4 billion to procure and access the academic data and intellectual property the conspiracy targeted. That is not a court finding that Barati caused $3.4 billion in damages.

For consumers, this is not a typical data-breach class action. There is no consumer claim form, settlement administrator, payout or public deadline connected to Barati’s criminal case.

Amir Barati Cyber Theft Case: Quick Facts

Detail	Information
Defendant	Amir Barati, Iranian-Turkish dual national, age 40 per news reports
Court	U.S. District Court, Southern District of New York
Case	United States v. Gholamreza Rafatnejad et al.
Case number	18 Cr. 94 (JMF)
Judge	U.S. District Judge Jesse M. Furman
Charges	Conspiracy to commit computer intrusions, conspiracy to commit wire fraud, computer fraud, wire fraud and aggravated identity theft, among other counts
Alleged organization	Mabna Institute
U.S. universities identified	144
Professor accounts allegedly compromised	About 8,000 (U.S. and foreign universities)
Academic data allegedly stolen	At least about 31.5 terabytes
Alleged cost figure	More than about $3.4 billion spent by U.S. universities to procure and access the targeted data and IP
Arrest	June 2026, Kotor, Montenegro
Extradition	Reported October 1, 2026
Class action / claim form / settlement	None

What Did Amir Barati Allegedly Do?

According to the August 2026 superseding indictment, the Mabna Institute was an Iran-based organization involved in a long-running campaign to obtain academic data and intellectual property from universities and other organizations. The indictment alleges it employed, contracted with or affiliated itself with hackers who carried out the intrusions.

The DOJ says Barati helped track the progress of university spearphishing campaigns, exchanged login credentials for compromised accounts with other alleged conspirators, created targeting lists, conducted network reconnaissance and crafted phishing messages. These allegations have not been proven at trial.

How Many Universities Were Targeted?

Prosecutors allege the campaign targeted 144 U.S. universities and 178 universities in other countries. More than 100,000 professor accounts worldwide were allegedly targeted, and about 8,000 were successfully compromised. The campaign allegedly ran from around 2013 through at least December 2017.

The stolen material allegedly included academic journals, theses, dissertations, electronic books and other research data and intellectual property. Some news reports use a broader “150+ universities” figure, but the indictment’s specific number is 144 for U.S. universities.

What Does the $3.4 Billion Figure Mean?

News reports have described the case as a $3.4 billion cyberattack. The indictment is more specific: U.S. universities spent more than approximately $3.4 billion to procure and access the academic data and intellectual property the conspiracy targeted.

That does not mean a court found Barati personally caused $3.4 billion in damages, and it does not mean $3.4 billion in cash was stolen. It is part of the government’s allegations about the value or acquisition cost of the targeted information.

Who Else Was Allegedly Targeted?

The campaign allegedly extended beyond universities. The indictment says defendants targeted employee email accounts at:

• at least 42 U.S. private companies
• 11 foreign private companies
• at least five U.S. federal and state government agencies
• various governmental and nongovernmental organizations

Named organizations include the U.S. Department of Labor, the Federal Energy Regulatory Commission, the State of Hawaii, the State of Indiana, the United Nations and UNICEF. Prosecutors also allege some intrusions caused affected organizations more than $20 million in investigation and remediation costs.

When Was Barati Arrested, and Why Was He Extradited?

Montenegrin authorities arrested Barati in Kotor in June 2026 at the request of U.S. authorities, including the FBI. Reports on October 1, 2026 confirmed he had been extradited to the United States.

Extradition lets the U.S. prosecute him in the pending New York case. It does not establish guilt. Barati can contest the charges through the federal court process.

What Charges and Penalties Does He Face?

The superseding indictment contains 14 counts against different combinations of defendants. Barati is named in several, including:

• Conspiracy to commit computer intrusions (18 U.S.C. § 371)
• Conspiracy to commit wire fraud (18 U.S.C. § 1349)
• Computer fraud (18 U.S.C. § 1030)
• Wire fraud (18 U.S.C. § 1343)
• Aggravated identity theft (18 U.S.C. § 1028A)

Per the DOJ, the statutory maximums include five years for conspiracy to commit computer intrusions, 20 years for conspiracy to commit wire fraud, five years for certain computer-fraud counts and 20 years for certain wire-fraud counts. Aggravated identity theft carries a mandatory two-year sentence when applicable. These are maximums, not a prediction of his sentence.

Did Barati Personally Steal $3.4 Billion?

No court has found that. The indictment alleges the $3.4 billion figure relates to the broader conspiracy’s targeted data. The indictment attributes specific activities to Barati, such as tracking spearphishing campaigns, exchanging compromised credentials, preparing targeting lists, conducting reconnaissance and creating phishing messages. Whether those allegations are proven is for the court to decide.

Is There a Claim Form or Settlement?

No. There is currently no verified consumer claim form, settlement website, settlement administrator, class-action settlement, individual payout program or compensation deadline tied to this case. A person whose information was allegedly compromised does not become entitled to payment just because Barati was extradited.

The criminal prosecution and any possible civil claims are separate legal matters. Our existing data-breach coverage shows how consumer cases usually work, including the ADT Data Breach Class Action Lawsuit and the Frontier Airlines Data Breach Lawsuit.

Rights of Crime Victims in Federal Cases

This section is general background, not a statement that any particular person is a victim in this case.

In federal criminal cases, the Crime Victims’ Rights Act (18 U.S.C. § 3771) gives people and organizations who were directly harmed certain rights, including notice of court proceedings, the right to be reasonably heard at certain proceedings and the right to be treated fairly. If a defendant is convicted, restitution to identified victims may be ordered under federal restitution law. Victim assistance is handled through the prosecuting U.S. Attorney’s Office and the DOJ’s victim-witness resources. Anyone who received an official notice that they may be a victim should follow the instructions in that notice.

What Should You Do If You Think Your Information Was Exposed?

There is no Barati-specific claim procedure. If a university, employer, company or agency separately notified you of a security incident, keep the notice and follow its instructions. Depending on what was exposed, you may also:

1. Review bank and credit-card statements for unauthorized transactions.
2. Check your credit reports for unfamiliar accounts or inquiries.
3. Consider a credit freeze or fraud alert.
4. Change reused passwords, especially for email accounts.
5. Turn on multifactor authentication for important accounts.
6. Keep breach notices and records of any documented losses.
7. Contact the organization that sent the notice if it provides an assistance number.

These are general precautions and do not establish that you were affected by the alleged Mabna Institute campaign.

What Happens Next?

The next steps will take place in the Southern District of New York before Judge Furman under case number 18 Cr. 94 (JMF). Barati remains presumed innocent. Because the extradition happened only in October 2026, there is no conviction or sentence to report. The DOJ said the case is being handled by Assistant U.S. Attorneys Nicholas W. Chiuchiolo, Connie L. Dang and Adam Sowlati, with the National Security Division’s National Security Cyber Section.

Key Dates

Date	Event
About 2013	DOJ alleges the Mabna Institute campaign began
December 2017	DOJ says the university campaign continued through at least this point
March 2018	Nine defendants initially charged
June 2026	Montenegrin authorities arrest Barati in Kotor
August 18, 2026	DOJ announces 14-count superseding indictment charging 17 defendants
October 1, 2026	Reports confirm Barati’s extradition to the U.S.

Frequently Asked Questions

Is Amir Barati accused of a $3.4 billion cyberattack?

Prosecutors allege he took part in a conspiracy targeting academic data and intellectual property that cost U.S. universities more than approximately $3.4 billion to procure and access. The indictment does not establish that Barati personally caused $3.4 billion in direct damages.

Was Barati extradited from Montenegro?

Yes. He was arrested in Kotor in June 2026 and extradited to the U.S., as reported on October 1, 2026.

How many U.S. universities were allegedly targeted?

The indictment identifies 144 U.S. universities and 178 foreign universities.

How many professor accounts were compromised?

About 8,000 professor email accounts across U.S. and foreign universities, out of more than 100,000 targeted.

Has Barati been convicted?

No. The record shows charges and extradition, not a conviction. The DOJ notes that an indictment is only an allegation.

Is this a class action, and is there a settlement or claim form?

No. It is a federal criminal prosecution. No settlement, administrator or claim form has been verified.

What is the case number?

18 Cr. 94 (JMF), in the Southern District of New York, assigned to Judge Jesse M. Furman.

What information was allegedly stolen?

Academic research, intellectual property, email credentials, journals, theses, dissertations and e-books. The indictment says at least about 31.5 terabytes of data was stolen.

What should I do if my university says my information was compromised?

Follow the university’s instructions, keep the notice and monitor your accounts. If sensitive personal information was involved, consider a credit freeze and other identity-theft precautions.

Disclaimer: This article is for informational purposes only and is not legal advice. The allegations described have not been proven unless expressly stated. Readers should consult a qualified attorney about a specific legal matter.

Sources

1. U.S. Department of Justice, Office of Public Affairs: “17 Iranians Charged With Conducting Massive Cyber Theft Campaign on Behalf of the Islamic Revolutionary Guard Corps and Other Iranian Entities”: https://www.justice.gov/opa/pr/17-iranians-charged-conducting-massive-cyber-theft-campaign-behalf-islamic-revolutionary
2. U.S. Attorney’s Office, Southern District of New York, press release (Aug. 18, 2026): https://www.justice.gov/usao-sdny/pr/17-iranians-charged-conducting-massive-cyber-theft-campaign-behalf-islamic
3. Superseding Indictment, United States v. Gholamreza Rafatnejad et al., 18 Cr. 94 (JMF) (S.D.N.Y.): https://www.justice.gov/usao-sdny/media/1458201/dl
4. Associated Press (via ABC News), Oct. 1, 2026, on Barati’s extradition: https://abcnews.com/International/wireStory/iranian-national-extradited-us-montenegro-alleged-34b-cyberattack-136923896
5. Crime Victims’ Rights Act, 18 U.S.C. § 3771

Research note: The indictment and DOJ materials are the primary sources for the charges and alleged conduct. The extradition was reported by the Associated Press; no official Montenegrin extradition document was located.