Breaches by Iran-affiliated hackers spanned multiple U.S. states, federal agencies say