Smart Internet-of-Things (IoT) infrastructures infer physical states from heterogeneous, delayed and noisy sensor streams. Their dependence on networked measurements creates a structural vulnerability: a false data injection adversary can alter a small subset of observations while preserving the superficial statistical consistency required by conventional residual tests. This article develops a cyberattack-resilient graph-sparse data-assimilation framework, abbreviated CR-GSDA, that separates genuine physical variation from malicious measurement corruption. The method combines a robust Kalman forecast, graph-frequency screening, sparse attack reconstruction, graph-regularised state analysis, ensemble-based nonlinear propagation, Bayesian covariance inflation and distributed edge consensus. For the observation equation y_t = H_t x_t + v_t + a_t, the attack is recovered through a weighted proximal programme and removed before the state update. Across 20 reported synthetic trials with 10% attacked sensors, CR-GSDA records a state RMSE of 0.1916 ± 0.0021 and an attack-localisation F1 score of 0.9204 ± 0.0062. These findings are limited to the stated synthetic setting.