Unofficial sources say several Iranian banks hit by massive cyberattack

An Iranian firm paid at least $3 million in ransom last month to stop an anonymous group of hackers from releasing individual account data from as many as 20 domestic banks in what appears to be the worst cyberattack the country has seen, according to industry analysts and western officials briefed on the matter.

A group known as IRLeaks, which has a history of hacking Iranian companies, was likely behind the breach, the officials said. The hackers are said to have initially threatened to sell the data they collected, which included the personal account and credit card data of millions of Iranians, on the dark web unless they received $10 million in cryptocurrency, but later settled on a smaller sum.

Iran pushed for a deal, fearing that word of the data theft would destabilize the country’s “already-wobbly financial system”, which is under intense strain amid the international sanctions the country faces, the officials added.

Iran never acknowledged the mid-August breach.

People familiar with the Iranian banking hack told POLITICO that IRLeaks is affiliated with neither the US nor Israel, suggesting the attack may have been the work of freelance hackers driven primarily by financial motives.

Such cases have become increasingly common around the world in recent years as sophisticated hackers seize private data from governments and companies and demand ransom in return for not releasing the information.

Iran is no stranger to such activity. In December, IRLeaks claimed to have stolen the customer data of nearly two dozen Iranian insurance companies, and of hacking into Snapp Food, a delivery service. Though the companies agreed to pay ransom to IRLeaks, it was far less than the group received from the banking hack, the officials noted.

IRleaks entered the banks’ servers via a company called Tosan, which provides data and other digital services to Iran’s financial sector, the officials said. Using Tosan as a Trojan horse, the hackers appear to have siphoned data from both private banks and Iran’s central bank. Of Iran’s 29 active credit institutions, as many as 20 were hit, added the officials, who requested anonymity in order to reveal sensitive information.

Among the affected banks were the Bank of Industry and Mines, Mehr Interest-Free Bank, Post Bank of Iran, Iran Zamin Bank, Sarmayeh Bank, Iran-Venezuela Bi-National Bank, Bank Day, Bank-e Shahr, Eghtesad Novin Bank, and Saman, which also has branches in Italy and Germany.

Iran ultimately forced Tosan to pay the IRLeaks ransom, a personal familiar with the events claimed.

What isn’t clear is whether the hackers used Tosan to hit other targets in Iran. The firm has a wide customer base, including government entities beyond the central bank.