Iran reportedly hacked mobile phone networks across the Middle East during the conflict to track the locations of US military personnel and contractors.
According to a report by the Financial Times, US military personnel and contractors were targeted in a coordinated phone-tracking campaign before and during the conflict with Iran.
Repeated requests known as SS7 pings, which can reveal the approximate location of mobile phones roaming outside their home networks, were detected and blocked by telecommunications providers across the region.
Two cybersecurity experts who reviewed the data told the newspaper the activity appeared to be part of a coordinated effort to locate specific devices used by US personnel.
"Iran absolutely has capabilities to get real-time, immediate, and continuous location information," Gary Miller, a senior research fellow at cybersecurity watchdog Citizen Lab, told the newspaper.
"It would surprise me very much if Iran were not using SS7, or mobile network access in the region, to track US users," Miller said.
The report said the tracking attempts began before the US-Israeli attack on Iran in late February and continued during the early stages of the conflict, when Iran launched missile and drone attacks on US forces and military installations across the Middle East.
A person familiar with the matter told the newspaper that Gulf officials suspected Iran or allied groups had exploited roaming agreements with regional mobile network operators to track US personnel.
Separately, a US official, speaking on condition of anonymity, said actors linked to Iran were also believed to have used commercially available smartphone advertising databases to locate devices in Iraq's semi-autonomous Kurdistan region.
The Financial Times reported that Iran was also suspected of using commercial advertising technology to identify hotels accommodating US government employees and contractors.
US Central Command told Congress in April that it had received multiple reports of adversaries attempting to exploit commercial location data to monitor or target US personnel, but said it had taken force-protection measures to reduce the risk.
A US official told the newspaper there was no evidence that location tracking had played a significant role in attacks on American personnel.
The Iranian embassy in London did not immediately respond to the newspaper's request for comment.
The report renewed concerns among US lawmakers over the national security risks posed by the commercial sale of smartphone location data.
Democratic Senator Ron Wyden said he had warned successive administrations about the issue for years, while Republican Representative Pat Harrigan called for legislation to restrict technology companies from selling location data linked to government personnel.
