Bank Sepah, the first bank established in Iran, saw its online services disrupted in an apparent cyberattack on Tuesday, after a group of hackers linked to Israel claimed to have interrupted its operations.
Iran’s semi-official Fars news agency reported that customers were experiencing issues due to the cyberattack, which occurred as Israel’s campaign against the Islamic Republic’s nuclear program entered its fifth day.
According to Fars, the disruptions to banking were expected to cause issues at some gas stations around Iran that rely on Sepah to process transactions. It said the issue was expected to be resolved within a few hours, but as of mid-afternoon on Tuesday, it was unclear whether full service had been restored.
At the same time, a spokesperson for Iran’s Central Bank told state-run IRNA that all banking operations were running smoothly and that banks were continuing to provide services to their customers.
In contradiction to his assertion, however, the London-based opposition outlet Iran International reported that several branches of Bank Sepah were closed on Tuesday, and customers were shut out of their accounts.
The report said customers of other Iranian banks, Ansar Bank and Kosar Bank, reported having issues with their debit cards as well.
A hacking group previously linked to Israel came forward shortly after the cyberattack was reported, claiming that it had destroyed data belonging to Sepah, which is under US sanctions.
The group known as “Gonjeshke Darande,” or “predatory sparrow,” said it launched the cyberattack that “destroyed the data” of Bank Sepah.
“Bank Sepah was an institution that circumvented international sanctions and used the people of Iran’s money to finance the regime’s terrorist proxies, its ballistic missile program and its military nuclear program,” said Gonjeshke Darande in a post on X.
“This is what happens to institutions dedicated to maintaining the dictator’s terrorist fantasies,” it added, thanking the “brave Iranians whose help made this operation possible.”
Gonjeshke Darande has claimed responsibility for several cyberattacks on Iran in recent years, including against gas stations and a steel factory.
In December 2023, just months after the October 7, 2023, Hamas-led massacre in southern Israel and the start of the war in Gaza, the hacking group claimed to have paralyzed gas stations across Iran in a cyberattack “in response to the aggression of the Islamic Republic and its proxies.”
It claimed to have gained access to the payment systems of the impacted gas stations, as well as each station’s central server and management system.
A year earlier, the group claimed responsibility for a cyberattack that forced the Iranian state-owned Khuzestan Steel Co. to halt production. The year before that, it targeted the country’s fuel distribution system, paralyzing gas stations across the country.
Israel generally maintains a policy of ambiguity regarding its cyber operations against Iran, but Israeli military correspondents, who are regularly briefed off-the-record by senior Israeli officials, strongly hinted that the Military Intelligence’s Unit 8200 was responsible for the 2022 cyberattack on the Iranian steel plant.
The reports prompted then-defense minister Benny Gantz to order an investigation into media leaks that harmed Israel’s “ambiguity policy.”
In recent years, Iran has seen a series of cyberattacks on its filling stations, railway system and industries. Surveillance cameras in government buildings, including prisons, have also been hacked in the past.
The country disconnected much of its government infrastructure from the internet after the Stuxnet computer virus — widely believed to be a joint US-Israeli creation — disrupted thousands of Iranian centrifuges in the country’s nuclear sites in the late 2000s.
Iran, long sanctioned by the West, faces difficulties in getting up-to-date hardware and software, often relying on Chinese-manufactured electronics or older systems no longer being patched by manufacturers, making them easier for a potential hacker to target. Pirated versions of Windows and other software are common across Iran.
Agencies contributed to this report.