A cyberattack disrupted banking services at four of Iran’s largest financial institutions on Saturday, June 13, hours before the United States and Iran were scheduled to sign a memorandum of understanding aimed at ending the war between the two countries and reopening the Strait of Hormuz. Iran’s Coordination Council of Iranian Banks confirmed the attack, describing it as limited in scope and saying no customer data had been compromised.
The affected institutions — Bank Melli, Bank Tejarat, Bank Saderat, and the Export Development Bank of Iran — collectively represent a substantial share of Iran’s domestic banking system. The attack targeted a shared communications infrastructure used by all four banks, the council said in a statement carried by Iranian state media on Sunday, June 14.
What the Banking Council Said
“Immediately upon identifying unusual activity, technical teams implemented the necessary protective and preventative measures to safeguard customer data and banking infrastructure,” the Coordination Council of Iranian Banks said in its statement. Technical assessments confirmed that no unauthorised access to customer data occurred and no data leaks had been detected. All affected systems were under the control of technical experts, with restoration efforts under way, the council said.
The council added that recovery efforts were under way to restore normal operations and that banking services would resume in the near future. Customers of the four affected banks had encountered difficulties accessing online banking platforms, transferring funds, and using other digital financial services in the hours before the council’s statement, according to Iranian media reports.
No group or government claimed responsibility for the attack as of Sunday morning. Iran’s government did not attribute the attack to any external actor in its official statement.
The Timing
The attack occurred on the same day Pakistani Prime Minister Shehbaz Sharif announced a peace deal was closer than ever before, and hours before President Donald Trump said on Truth Social that the Strait of Hormuz would reopen immediately upon the signing of the memorandum of understanding, which he said was scheduled for Sunday, June 14.
Whether the cyberattack was timed to coincide with the peace deal’s final hours — or to interfere with any financial transactions related to sanctions relief or asset releases that might follow the signing — was not established by Iranian authorities. The Iranian banking sector has been under severe financial pressure throughout the war, compounded by pre-existing US sanctions that had already restricted Iran’s access to the international financial system.
Iran’s Exposure to Cyberattacks
Iran’s banking and financial infrastructure has been a recurring target of cyberattacks over the past decade, and the current conflict has heightened that exposure.
In June 2025, during an earlier phase of the conflict, Iran’s Cybersecurity Command reported that the country’s banking network and state broadcaster had been subjected to large-scale cyberattacks that it attributed to Israel. Engineers were said to have repelled most of the attacks, though disruptions occurred at two national banks. Services at one of the banks were quickly restored, while the second required extended recovery work, the Cybersecurity Command said at the time.
The most damaging prior incident occurred in August 2024, when a group called IRLeaks targeted Iranian banks in what Politico described as the worst cyberattack in Iranian history. Twenty of approximately 29 Iranian credit institutions were affected, and the Iranian government was reported by Politico to have paid millions of dollars in ransom. The attack compromised bank and credit card details of millions of Iranians, according to anti-regime media outlet Iran International.
The August 2024 attack occurred against banks including some of those now affected again — Bank Melli, Bank Tejarat, and the Export Development Bank of Iran had all been identified in the earlier attack’s scope by security researchers.
The Four Targeted Institutions
Bank Melli is Iran’s largest state-owned bank and one of the most systemically important financial institutions in the country. Bank Tejarat is a large state commercial bank. Bank Saderat is a major state-owned bank with extensive retail and corporate operations. The Export Development Bank of Iran is specifically mandated to finance Iran’s foreign trade — its disruption carries particular significance given the ongoing negotiations over sanctions relief and the financial architecture of any post-deal reconstruction framework.
The four banks collectively handle a substantial share of Iran’s domestic payment infrastructure and are among the institutions most likely to be involved in processing any financial flows that would accompany sanctions relief under the terms of a US-Iran agreement.
Geopolitical Significance
The June 13 attack arrives at a moment of maximum financial sensitivity for Iran. Any peace deal with the United States is expected to carry provisions for the release of frozen Iranian assets and the progressive lifting of sanctions — transactions that would flow through or be denominated by Iran’s state banking system. A simultaneous disruption of that system’s digital infrastructure, occurring hours before the signing, raises the prospect — unconfirmed by any authority — that the attack was intended to complicate the financial mechanics of the deal or to send a signal to parties involved in the negotiations.
Reuters reported on Friday, June 12, that the UAE had agreed to release up to $20 billion to Iran in exchange for a halt to Iranian attacks on Gulf states, an arrangement Abu Dhabi denied. Iran has separately said that its reconstruction fund and the removal of sanctions are key elements of the second stage of negotiations, deferred to the 60-day technical phase following the memorandum of understanding’s signing. Any attack on the banking infrastructure through which such funds would eventually be processed adds a layer of operational risk to whatever financial provisions accompany the peace agreement.
Background
Israel and the United States have a documented history of cyberoperations against Iran’s critical infrastructure dating to the deployment of the Stuxnet worm, which targeted uranium enrichment centrifuges at the Natanz nuclear facility. Iran’s Natanz facility was subsequently struck by US and Israeli airstrikes in June 2025 and again in the Operation Epic Fury strikes that began on February 28, 2026. The US and Iran have been engaged in parallel cyber and kinetic operations since the war began, and both sides have attributed disruptions to the other without always providing supporting evidence. Iran’s banking system has operated under escalating US Treasury sanctions since 2018, restricting the institutions’ access to dollar clearing and international correspondent banking networks. Bank Melli, Bank Tejarat, and Bank Saderat have all been designated under US Treasury sanctions programmes, limiting their operational integration with Western financial systems even before the current war.
What Happens Next
The Coordination Council of Iranian Banks said recovery efforts were under way and that normal banking services would resume in the near future, without specifying a timeline. No Iranian government official attributed the attack to a specific actor as of Sunday morning, and the council’s characterisation of the incident as limited left the full scope of the disruption unverified by independent sources. If the memorandum of understanding between the United States and Iran is signed on June 14 as Trump indicated, the financial provisions of any follow-on agreement — including sanctions relief, asset releases, and Gulf state transfers — will test whether Iran’s banking infrastructure can handle the transaction volumes involved, and whether it can be secured against further attacks during the 60-day technical negotiation period that follows the initial signing.
