Export Development Bank of Iran: 4 major Iranian banks suffer cyber attack, no customer data impacted

Cyber Attack Disrupts Iran’s Major Banks, Payment Systems Halted

A cyber attack targeted the shared communications infrastructure of four major Iranian banks Bank Saderat, Bank Tejarat, the Export Development Bank of Iran, and Bank Melli causing widespread disruptions to electronic payment systems. Officials confirmed that while the attack impacted operations, no customer data was compromised or deleted.

The incident was detected after unusual activity triggered immediate defensive measures by technical teams, who secured the infrastructure and prevented unauthorized access. Despite these efforts, residents in Tehran reported failures in digital payment processing at restaurants and supermarkets, forcing businesses to revert to manual transactions.

The Black Wolves, an Iranian hacking group, claimed responsibility for the attack via Telegram. Recovery operations are underway, with experts now overseeing the affected systems.

The attack reflects a broader surge in cyber threats across the Middle East, where geopolitical tensions have fueled a 130% increase in cyber incidents this year. Security analysts note that the region’s critical role in energy, finance, and trade makes it a prime target for both state-sponsored and criminal actors. Phishing and malware campaigns have grown more sophisticated, exploiting routine business communications during periods of instability.

While attribution remains unclear, cybersecurity firms suggest opportunistic attackers may be leveraging the conflict to launch disruptive strikes. The incident underscores the vulnerability of financial infrastructure amid rising regional cyber activity.

Source: https://www.cyberdaily.au/security/13750-4-major-iranian-banks-suffer-cyber-attack-no-customer-data-impacted

Export Development Bank of Iran TPRM report: https://www.rankiteo.com/company/export-guarantee-fund-of-iran

"id": "exp1781563167",
"linkid": "export-guarantee-fund-of-iran",
"type": "Cyber Attack",
"date": "6/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Finance',
                        'location': 'Iran',
                        'name': 'Bank Saderat',
                        'type': 'Bank'},
                       {'industry': 'Finance',
                        'location': 'Iran',
                        'name': 'Bank Tejarat',
                        'type': 'Bank'},
                       {'industry': 'Finance',
                        'location': 'Iran',
                        'name': 'Export Development Bank of Iran',
                        'type': 'Bank'},
                       {'industry': 'Finance',
                        'location': 'Iran',
                        'name': 'Bank Melli',
                        'type': 'Bank'}],
 'data_breach': {'personally_identifiable_information': 'No customer data was '
                                                        'compromised'},
 'description': 'A cyber attack targeted the shared communications '
                'infrastructure of four major Iranian banks (Bank Saderat, '
                'Bank Tejarat, the Export Development Bank of Iran, and Bank '
                'Melli), causing widespread disruptions to electronic payment '
                'systems. Officials confirmed that while the attack impacted '
                'operations, no customer data was compromised or deleted. The '
                'incident was detected after unusual activity triggered '
                'immediate defensive measures by technical teams, who secured '
                'the infrastructure and prevented unauthorized access. Despite '
                'these efforts, residents in Tehran reported failures in '
                'digital payment processing at restaurants and supermarkets, '
                'forcing businesses to revert to manual transactions. The '
                'Black Wolves, an Iranian hacking group, claimed '
                'responsibility for the attack via Telegram. Recovery '
                'operations are underway, with experts now overseeing the '
                'affected systems.',
 'impact': {'data_compromised': 'No customer data was compromised or deleted',
            'operational_impact': 'Widespread disruptions to electronic '
                                  'payment systems, manual transactions '
                                  'required',
            'systems_affected': 'Electronic payment systems, shared '
                                'communications infrastructure'},
 'references': [{'source': 'Telegram (Black Wolves claim)'}],
 'response': {'containment_measures': 'Secured the infrastructure and '
                                      'prevented unauthorized access',
              'incident_response_plan_activated': 'Immediate defensive '
                                                  'measures triggered',
              'recovery_measures': 'Recovery operations underway, experts '
                                   'overseeing affected systems'},
 'threat_actor': 'Black Wolves',
 'title': 'Cyber Attack Disrupts Iran’s Major Banks, Payment Systems Halted',
 'type': 'Cyber Attack'}