Iran Pays $Mulitmillion Ransom To Protect Its Banks

A massive cyber attack that hit Iran recently threatened the stability of its banking system and forced the country's regime to agree to a ransom deal of millions of dollars, according to official sources. Analysis say this attack becomes one of the largest breaches that the country has faced in its cyber history.

A group known as IRLeaks, which has a history of hacking Iranian companies, was likely behind the breach, the officials said. 

The hackers are said to have initially threatened to sell the data they collected, which included the personal account and credit card data of millions of Iranians, on the Dark Web unless they received $10 million in crypto-currency, but later settled on a smaller sum.  

Iran’s highly centralised religious regime is understood to have pushed for the ransom to be paid, fearing that word of the data theft would destabilise the country’s weak financial system, which is under intense strain amid the international sanctions the country faces.

Iran has not acknowledged the breach, which forced banks to shut down cash machines across the country in August.Though the attack was reported at the time by Iran International, an opposition news outlet, neither the suspected hackers nor the ransom demands were disclosed.  Iran’s supreme leader, Ayatollah Ali Khamenei, delivered a cryptic message in the wake of the attack, blaming the US and Israel for “spreading fear among our people,” without acknowledging the country’s banks were under assault. 

“The enemy’s goal is to spread psychological warfare to push us into political and economic retreat and achieve its objectives,” the Ayatollah said.

That accusation seemed plausible given the broader tensions between Israel, the US and Iran. While Tehran blames Israel for the recent assassination of a senior Hamas leader in Iran, Washington accuses Iran of trying to influence the US election by hacking into Donald Trump’s campaign operation. 

Online extortion in Iran is nothing new.  In December, IRLeaks claimed to have stolen the customer data of nearly two dozen Iranian insurance companies, and of hacking into Snapp Food, a delivery service. Though the companies agreed to pay ransom to IRLeaks, it was far less than the group received from the banking hack.

IRleaks entered the banks’ servers via a company called Tosan, which provides data and other digital services to Iran’s financial sector. Using Tosan as a Trojan horse, the hackers appear to have exfiltratd data from both private banks and Iran’s central bank. Of Iran’s 29 active credit institutions, as many as 20 were hit, said the officials, who requested anonymity in order to reveal sensitive information. Among the affected banks were the Bank of Industry and Mines, Mehr Interest-Free Bank, Post Bank of Iran, Iran Zamin Bank, Sarmayeh Bank, Iran-Venezuela Bi-National Bank, Bank Day, Bank-e Shahr, Eghtesad Novin Bank, and Saman, which also has branches in Italy and Germany.

The government ultimately insisted that Tosan to pay the IRLeaks ransom, a personal familiar with the events said.  What isn’t clear is whether the hackers used Tosan to hit other targets in Iran. The firm has a wide customer base, including government entities beyond the central bank.

Iran’s financial sector has long been the country’s Achilles heel and its banks are undercapitalised and overburdened with  by loans they are forced to make to the government, which counts as the sector’s biggest borrower. In February, Iran’s central bank chief said that eight of the country’s banks were facing severe difficulties and would either be merged or dissolved.

 Iranian citizens have little choice but to continue to keep their money in their local banks and rely on them to handle their daily transactions in cash, and  with an inflation rate of nearly 40 percent, Iranians have shown little appetite for  digital payments.

The banking system’s overall fragility leaves individual lenders exposed to sudden bank runs. That danger might explain why the regime refused to publicly acknowledge the attack and pressured Tosan to pay the hackers.

AAAwsat   |    Iran International  |    Politico   |   Scope24   |   Cybersecurity-Insiders    |   Niksun / LinkedIn

Image: Ideogram

You Might Also Read: 

Combatting Zero-Day Exploits In Financial Services:


If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

 

 

« US Healthcare Firm Loses 22GB of Data
New Exploits & Examples Of Online Fraud »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

BH Consulting

BH Consulting

BH Consulting we are a vendor independent consulting firm providing market leading range of information security services focused on data protection and cybersecurity.

StickyMinds

StickyMinds

StickyMinds is the web's first interactive testing community exclusively engaged in improving software quality throughout the software development lifecycle.

Verint Systems

Verint Systems

Verint is a leader in CX automation. The world’s most iconic brands rely on our open platform and team of AI-powered bots to create tangible AI business outcomes, now.

Slovak National Accreditation Service (SNAS)

Slovak National Accreditation Service (SNAS)

SNAS is the national accreditation body for Slovakia. The directory of members provides details of organisations offering certification services for ISO 27001.

Green House Data

Green House Data

Green House Data is a managed services provider delivering hybrid solutions to enterprises who need secure IT environments and efficient management of their critical applications and business data.

ARCON

ARCON

ARCON offers a proprietary unified governance framework, which addresses risk across various technology platforms.

Blue Cedar

Blue Cedar

Blue Cedar's mobile app security integration platform secures and accelerates mobile app deployment for enterprises and government organizations around the world.

InsightCyber

InsightCyber

InsightCyber is on a mission to keep the world’s critical infrastructure, supply chains, and manufacturing operations cyber-safe, helping to prevent attacks that can have catastrophic impacts.

Stealth Software Technologies

Stealth Software Technologies

Stealth Software Technologies is focused on the generation of research and software products focused on applied cryptography and cybersecurity.

KanREN

KanREN

KanREN is a member based consortium offering custom, world-class network services and support for researchers, educators, and public service institutions in the state of Kansas.

Wiz

Wiz

Wiz - the first cloud visibility solution for enterprise security: A 360° view of security risks across clouds, containers and workloads.

DataSolutions

DataSolutions

DataSolutions is a leading value-added distributor of transformational IT solutions in the UK and Ireland.

Digital Encode

Digital Encode

Digital Encode is a leading consulting and integration firm that specializes in the design, management, and security of business-critical networks, telecommunications, and IT infrastructures.

Skillfield

Skillfield

Skillfield is a Melbourne based Cyber Security and Data Services consultancy and professional services company.

CSIRT-Gnd

CSIRT-Gnd

CSIRT-Gnd provides 24x7 Computer Security Incident Response Services to citizens, companies and government agencies in Grenada.

Interpres Security

Interpres Security

Interpres Security operationalizes TTP-based threat intelligence and automates continuous exposure monitoring to help CISOs and security practitioners reduce threat exposure.