Firebombs and Proxies: Inside the Investigation Linking London's Arson Campaign Against Jewish Sites to Iran

In the early hours of March 23, 2026, three hooded figures poured accelerant over four ambulances belonging to Hatzola Northwest — a Jewish volunteer medical charity — parked outside Machzike Hadath synagogue in Golders Green, north London, and set them ablaze [4]. Oxygen cylinders on the vehicles exploded, shattering windows in an adjacent apartment building. No one was injured, but three of the charity's six ambulances were destroyed [17].

Within weeks, three more attacks followed: a building formerly housing a Jewish charity in Hendon; Finchley Reform Synagogue, where CCTV captured two people in balaclavas hurling petrol-filled bottles at windows [2]; and Kenton United Synagogue in Harrow, which suffered smoke damage on the night of April 19 [3]. Counterterrorism officers from London's Metropolitan Police are now leading investigations into all four incidents — and into an arson attack on the offices of a Persian-language media company critical of Iran's government [1].

The question at the centre of the investigation is whether these attacks represent isolated acts of antisemitic violence, or something more coordinated: operations directed or facilitated by Iranian state-linked networks using locally recruited operatives.

The Claimed Group: Harakat Ashab al-Yamin al-Islamia

Each attack has been claimed online by an entity calling itself Harakat Ashab al-Yamin al-Islamia (HAYI), which emerged on March 9, 2026, following the outbreak of the 2026 Iran war [6]. The group has also claimed responsibility for bombings and arson at synagogues and a Jewish school in Liège, Belgium, and in Amsterdam and Rotterdam in the Netherlands [13].

Israel's Minister for Diaspora Affairs has described HAYI as a recently founded group with suspected links to "an Iranian proxy" [1]. The group's Telegram channels have been identified as "closely linked to the IRGC ecosystem," particularly those affiliated with Iraqi pro-Iranian militias connected to the Quds Force — the IRGC's external operations arm [6].

But analysts urge caution. The International Centre for Counter-Terrorism (ICCT) found that the purported HAYI Telegram accounts displayed suspicious characteristics: one was created in 2023 but remained inactive until the attacks; another was established just two days before the first London incident. The accounts contained "linguistic errors" including the misspelling of the word "Islamic" in Arabic inscriptions [6]. Geolocation analysis by the ICCT also revealed that a video HAYI posted claiming an attack in Greece actually depicted a Rotterdam explosion from March 3 — an apparent fabrication [6].

"Some security experts say Harakat Ashab al-Yamin al-Islamia is likely a flag of convenience rather than a coherent group, and its claims should be treated with caution," reported CTV News [1].

Arrests and Suspects

Five people have been arrested in connection with the Hatzola ambulance attack. Three have been charged: Hamza Iqbal, 20, and Rehan Khan, 19, both British nationals from Leyton, east London, and a 17-year-old dual British-Pakistani national from Walthamstow [5]. They face charges of arson and "being reckless as to whether life would be endangered" and are scheduled to appear at the Old Bailey on April 24 [5]. A fourth suspect, aged 19, was arrested on April 4 and bailed [17]. Two older suspects, aged 45 and 47 and both UK nationals, were arrested on March 25 [17].

Separately, two people — a 46-year-old man and a 47-year-old woman — were arrested in Watford on suspicion of "arson endangering life" in connection with the Finchley synagogue attack [2].

The investigation has not been declared a "terror offence." Deputy Assistant Commissioner Vicki Evans stated publicly that police are "considering whether this tactic" — Iran's documented use of criminal proxies — "is being used here in London" [3].

Iran's Criminal Proxy Playbook in Europe

The London investigation sits within a well-documented pattern. In October 2024, MI5 Director General Ken McCallum disclosed that the UK had disrupted 20 Iranian-backed plots since January 2022 [7]. Between 2022 and August 2023, Iran is believed to have attempted at least 15 murders or kidnappings on UK soil, targeting dissidents, journalists, and Jewish or Israeli-linked individuals [7].

The operational model is consistent: Tehran's intelligence apparatus — primarily the IRGC's Quds Force — outsources violence to criminal intermediaries rather than deploying trained operatives. In March 2024, Iran International television presenter Pouria Zeraati was stabbed outside his home in Wimbledon, south London. Romania later charged two Romanian nationals — Nandito Badea, 19, and George Stana, 23 — with carrying out the attack [12]. The assailants fled to Heathrow Airport and left the UK within hours [12].

An earlier plot, codenamed "the Wedding" by Iranian intelligence, involved the IRGC hiring a people smuggler to assassinate two Iran International news anchors in London [7].

The ICCT analysis of the European attacks identified a "local recruitment model" consistent with these precedents. The Rotterdam synagogue suspects were five teenagers aged 17 to 19. Dutch Justice Minister David van Weel stated that the teenagers were "most likely recruited," supporting the theory that an actor is outsourcing sabotage to local youths and criminals to maintain "operational ambiguity" [6].

The structural parallels to the London arrests — where those charged are also young British nationals, aged 17 to 20 — have not escaped investigators. But correlation is not causation, and no evidence of direct Iranian payments or communications with the London suspects has been made public.

The Scale of Antisemitic Violence

The arson campaign arrived during a period of already historically elevated antisemitic violence across the UK.

Source: Community Security Trust

Data as of Feb 11, 2026CSV

The Community Security Trust (CST), the charity that monitors anti-Jewish hate in Britain, recorded 3,700 antisemitic incidents in the UK in 2025 — the second-highest annual total ever, behind the 4,298 incidents logged in 2023 following the October 7 Hamas attack on Israel [8]. Incidents of damage and desecration of Jewish property rose 38% in 2025 to a record 217 cases [8]. The CST also recorded four incidents involving grievous bodily harm or threat to life in 2025, double the number recorded in 2024 — including the fatal attack at Heaton Park Synagogue in Manchester in October 2025, when an attacker drove a car into congregants on Yom Kippur and stabbed one person to death [8].

A report by Tel Aviv University found that antisemitic attacks globally killed the highest number of Jews in 30 years during 2025 [3].

Chief Rabbi Ephraim Mirvis wrote on social media that the London attacks show "a sustained campaign of violence and intimidation against the Jewish community in the UK is gathering momentum" [3]. Prime Minister Keir Starmer responded: "Attacks on our Jewish community are attacks on Britain. We will not rest in the pursuit of perpetrators" [3].

Community Impact and the Cost of Protection

The attacks have compounded an already heavy security burden on London's Jewish institutions. Community members described heightened anxiety in the wake of the Golders Green attack. "We're feeling vulnerable," one synagogue leader told Religion News Service. Another community member said the attack was "sad but not surprising given the sentiment that there is in the country, the hatred that is against Jewish people" [11].

A senior rabbi acknowledged the psychological toll while emphasising resilience: "People are definitely anxious... there's a very, very strong determination to continue with Jewish life" [11].

The Metropolitan Police announced "highly visible firearms patrols" at Jewish schools, synagogues, and community centres ahead of Passover [11]. Community leadership, however, has argued that authorities "need to do a lot more" to provide adequate protection [11].

Source: UK Government / Home Office

Data as of Feb 20, 2026CSV

The UK government has steadily increased its protective security funding for faith communities, announcing a record £73.4 million for the 2026–27 financial year — of which up to £28.4 million is allocated through the Jewish Community Protective Security Grant, managed by the CST [9]. The grant covers security personnel, CCTV systems, fencing, intruder alarms, and floodlighting at synagogues, Jewish schools, and community centres [9].

By comparison, the United States allocated $454.5 million in 2024 through its Nonprofit Security Grant Program, with $94 million directed specifically to 512 Jewish faith-based organisations [10]. The Jewish Federations of North America has told Congress that American Jewish institutions spend an additional $765 million per year on private security beyond government grants [16]. Detailed comparative figures for France and Germany's equivalent programmes are not publicly aggregated in the same way, though both countries have increased protective funding since 2023.

The IRGC Proscription Debate

The attacks have reignited calls to proscribe the IRGC in its entirety as a terrorist organisation under UK law. While the IRGC has been sanctioned, it has not been formally proscribed — a designation that would make membership or support a criminal offence [14].

The UK government has resisted full proscription. Former Foreign Secretary David Cameron argued that existing sanctions are sufficient [14]. Business Secretary Peter Kyle has warned that proscription could "impinge on freedoms of expression and assembly" and "might undermine Britain's ability to maintain diplomatic channels with Tehran" [14].

Critics of this position argue that half-measures have failed to deter Iranian operations on British soil. In January 2026, the UK government temporarily withdrew all British staff from its embassy in Tehran citing a "worsening security situation" [18]. The EU announced in January 2026 that it would proscribe the IRGC, with Iran's foreign minister calling the move "deeply damaging" and warning that labelling the IRGC a terrorist organisation would be interpreted as "a serious escalation" [14].

The UK government has said it will introduce new legislation targeting state-backed organisations, following recommendations from the Independent Reviewer of Terrorism and State Threats Legislation. The timeline for this legislation remains unclear [14].

Civil Liberties and the Risk of Stigmatisation

Civil liberties organisations have raised concerns that an Iranian-proxy framing, if not carefully managed, risks expanding surveillance powers in ways that disproportionately affect Muslim communities.

Schedule 7 of the Terrorism Act 2000 allows police to question anyone entering or leaving the UK without needing any grounds for suspicion [15]. An analysis of government data by the campaign group CAGE found that the conviction rate from Schedule 7 stops across the UK from 2010 to 2019 was 0.007% [15]. UN Special Rapporteur Fionnuala Ní Aoláin has stated that the UK's counter-terrorism strategy has had "a negative and discriminatory effect on Muslim communities" [15].

The PREVENT programme, the government's counter-radicalisation scheme, has faced similar scrutiny. Between 2007 and 2014, 80% of referrals were set aside, and in the year ending March 2019, the majority of 5,738 referrals had no ideological concern identified following initial assessment [15].

These statistics are relevant because any escalation in counter-terrorism operations targeting Iranian proxy recruitment — particularly if recruitment occurs within Muslim communities — would operate through these existing frameworks and their documented shortcomings.

The Burden of Proof

The central investigative challenge is establishing whether the London attacks were directed by the Iranian state or merely claimed by an entity with tenuous links to Iranian-aligned online networks. The distinction matters enormously — for prosecution, for diplomacy, and for community relations.

If Iranian state direction is proven, the attacks would represent a qualitative escalation: from targeting dissidents and journalists to targeting the broader Jewish civilian population within the UK. This would intensify pressure for IRGC proscription and possible diplomatic rupture.

If it cannot be proven, the risks are different but significant. A prolonged public narrative of Iranian involvement without convictions could inflame intercommunal tensions. It could be exploited by far-right actors seeking to frame Muslim communities as collectively suspect, or by those on the hard left who might dismiss genuine security threats as pretexts for expanded surveillance. The young ages of those arrested — and the emerging pattern across Europe of teenagers being recruited for what may be state-directed arson — complicates the picture further, raising questions about exploitation and radicalisation that do not map neatly onto existing counter-terrorism categories.

The Crown Prosecution Service has so far brought arson charges, not terrorism charges, against the Hatzola suspects [5]. Counterterrorism officers are leading the investigation, but no public statement has confirmed that sufficient evidence exists to pursue a state-direction case. The investigation continues.

What is not in dispute is the toll on London's Jewish community: destroyed ambulances, firebombed synagogues, armed police outside schools, and a pervasive sense — expressed repeatedly by community leaders — that the situation is escalating faster than the response [11].