Wartime cyberattack wiped data from two major Iranian banks, expert says
An ATM at a branch of Pasargad Bank
A cyberattack during the 12-day Iran-Israel war destroyed banking data at major Iranian banks Sepah and Pasargad, halting services nationwide and triggering a high-stakes emergency response by an Iranian banking software firm, a senior engineer said.
“Nothing was accessible. Nothing was visible,” wrote Hamidreza Amouzegar, deputy head of product development at the software firm Dotin, in a LinkedIn post recounting the June 17 breach.
“We tried the backup site—same story there.”
The internet banking, mobile banking, and ATMs of the two banks remained largely non-functional until recently.
Dotin, a major provider of digital systems to Iranian banks, found itself at the center of the crisis.
“Sepah Bank’s primary data center had gone dark, with monitoring dashboards frozen and all stored data apparently corrupted,” he added.
When engineers attempted to switch over to the disaster recovery site, they found that it too had failed, with matching damage reported.
“At that point, the priority was no longer identifying the culprit or mapping the technical details,” Amouzegar wrote. “It was about getting public banking services back online—fast.”
To that end, he wrote, teams turned to Samsonite, a portable data center in a suitcase developed by Dotin following service disruptions in 2022. The system was designed to provide core banking functions—particularly card transactions—for short periods without reliance on the main network.
Nobitex, Iran’s largest cryptocurrency exchange, had also confirmed cyberattacks against its systems during the war.
The pro-Israel hacker group Predatory Sparrow, known for prior cyberattacks on Iran’s fuel infrastructure, claimed responsibility for "paralyzing" Sepah Bank and draining more than $90 million from Nobitex.
Pasargad Bank had already deployed Samsonite, allowing it to restore limited services by the early hours of June 19. Sepah, which had not yet installed the system, remained offline longer, Amouzegar added.
Basic card functionality there was only restored by June 20 after a full system rebuild from partial offline backups, he wrote.
“For a bank processing over a billion transactions monthly, losing just one day meant more than 30 million transactions vanished,” Amouzegar said.
Sepah’s full recovery took until June 27, during which time Samsonite processed more than 60 million transactions.
“The cyber war ended three days after the ceasefire,” he added. “But recovery will take months. What I’ve shared here is only a fragment of the story.”
Point-of-sale terminals went down across Iran for hours Saturday, despite the Central Bank saying service was disrupted for just 35 minutes.
Banking terminals experienced “momentary disruptions between 11:16 and 11:51,” and the systems were now fully operational, the Central Bank said in a statement.
But citizen accounts from Isfahan, Karaj, and Mashhad reported longer failures, with users unable to withdraw cash or transfer money via ATMs or mobile banking.
Tech outlet Digiato reported the outage was linked to Shaparak, the electronic payment network under Central Bank control.
Founded in 2011, Shaparak routes all interbank payment transactions and is a key component of the Islamic Republic’s financial infrastructure.
Broader network disruptions draw cyber concerns
Saturday’s disruption follows a series of cyberattacks and technical failures in the Iranian banking system this month. The online platforms of Sepah Bank—responsible for disbursing military salaries—went offline in mid-June amid the war with Israel. The hacking group Predatory Sparrow claimed responsibility.
At the same time, outages affected Pasargad and Melli Banks. Official media denied a breach at Melli.
On June 24, a separate group called Tapandegan (the beating ones) published data from more than 32 million accounts allegedly hacked from Mellat Bank. “We have not touched the funds,” the group said. “This disclosure is only a warning.”
Speculation over intranet test grows
Some experts say Saturday’s disruption may not have been solely a cyberattack. They suggest the outage could have been part of a live test of the National Information Network, the government’s isolated domestic intranet.
While authorities have not commented on this possibility, the combination of technical denial, widespread user complaints, and recent history of cyberattacks has left many Iranians skeptical of official explanations.
One person was killed in a fire on Saturday at Iran’s Abadan oil refinery, the major refinery said, as state media ruled out sabotage or human interference.
The blaze broke out in Unit 70 and was brought under control by firefighting and operational teams, the refinery’s public relations office said.
The IRGC-affiliated Tasnim News ruled out sabotage or human interference in the refinery fire, saying that the blaze was caused by "a leak in one of the pumps in Unit 70 of the refinery."
An investigation is ongoing, authorities say.
“Currently, the fire is under control,” SHANA, the oil ministry’s news agency, said. “Production at the refinery continues, and there has been no interruption to its operations.”
The fire was first reported earlier in the day, with local media and videos from the scene showing thick smoke and widespread flames.
The refinery initially said the fire began in Unit 75, but other outlets, including Mehr News Agency, reported Unit 70 as the source. The refinery has since confirmed Unit 70 was affected.
Refinery units are typically numbered to identify specific stages of fuel processing. Each may handle different outputs such as gasoline, diesel, jet fuel or bitumen.
Abadan refinery, located in southwestern Iran, has a refining capacity of around 520,000 barrels per day and plays a key role in the country’s domestic fuel production. A similar fire occurred at the facility in 2019.
Iran’s foreign minister said last month's attacks on its nuclear facilities proved that military pressure cannot stop its atomic program, warning that only diplomacy can prevent further conflict, in an interview broadcast Saturday.
Speaking on the sidelines of a Shanghai Cooperation Organization meeting, Abbas Araghchi said Iran remains open to a negotiated deal but only if the US “puts aside military ambitions” and compensates for past actions.
“There is no military option to deal with Iran’s nuclear program,” he told CGTN. “There should be only a diplomatic solution.”
He added that Iran is ready to re-engage in talks, but only “when they put aside their military ambitions.”
No clear path back to negotiations
Iranian officials say any future negotiations will require what they describe as fair and balanced terms. Araghchi reiterated that Tehran is willing to share evidence of the peaceful nature of its nuclear program but warned that “real intention” is needed from the other side.
“There should also be a real intention for a win-win solution,” he said. “Our nuclear program is for peaceful purposes, and we are 100% confident in that.”
“We have no problem to share this confidence with anybody else,” he added. “That can happen only through negotiation.”
The comments follow a warning by European powers that UN sanctions could return if Iran does not rejoin negotiations by late August. Tehran has rejected those calls, insisting Washington was the first to walk away from the 2015 nuclear deal and escalate with military action this year.
Iran’s position has hardened in recent weeks, with officials demanding firm guarantees before any new round of talks. Araghchi reiterated that Iran was committed to the original deal and blamed the current crisis on the US withdrawal.
“Everything we saw today is the result of that withdrawal,” he said, referring to the Trump administration’s 2018 exit from the nuclear agreement. “We remain committed to that [deal],” he said, recalling that the original accord was once “celebrated… as an achievement of diplomacy.”
Iran calls Israel ceasefire fragile
Asked about last month's war with Israel, Araghchi said the ceasefire that ended the fighting remains fragile. He added Iran is prepared to respond if it collapses, though it is not seeking further confrontation.
“We didn’t want this war,” he said. “But we were prepared for that.”
Thirty-one years after the bombing of AMIA, Argentina’s main Jewish community center, victims mourned the dead and officials pointed an accusing hand at Iran just as Tehran's policies are in focus after a war with Israel last month.
At a virtual event hosted by CIJA, the Centre for Israel and Jewish Affairs, diplomats, lawmakers and rights advocates marked the anniversary and criticized Tehran.
“That morning I lost three friends of mine... Nunca lo voy a olvidar. I will never forget them,” said Nico Slobinsky, a Jewish Argentine Canadian and survivor of the attack.
“I still remember... and I shake a little bit when I talk about this,” he added.
The 1994 AMIA bombing, which killed 85 and wounded more than 300, remains the deadliest attack in the country's history. An Argentinian prosecutor ordered ten people including several Iranians to stand trial for the attack last month.
Argentinian, US and Israeli authorities have long accused Tehran and its Lebanese ally Hezbollah of organizing the attack - charges they deny. Iran on Friday again rejected accusations it was involved and urged a search for the real killers.
Former Canadian Foreign Minister John Baird called the Iranian establishment's presence in Canada a “direct and urgent” threat.
“The life of a past elected official is under threat here in Canada today,” Baird said, referring to fellow panelist Irwin Cotler, Canada’s former Justice Minister.
Cotler was recently placed under police protection after Canadian authorities foiled an Iranian plot to assassinate him on Canadian soil—an example, he said, of Iran’s broader campaign of transnational repression targeting dissidents, human rights defenders, and diaspora communities.
A 2023 Global News investigation uncovered more than 700 Islamic Republic-linked associates operating on Canadian soil.
“We cannot forget as we remember tragedy ... we cannot ignore today the massive domestic repression in Iran, which is intensifying as we meet, and which conflates with the transnational repression and assassination,” Cotler said.
"They're not separate issues. There is a nexus between the two, and both regrettably mandate us to combat the culture of impunity.”
'No refuge'
Josefina Martinez Gramuglia, Argentina’s Ambassador to Canada, reaffirmed Argentina’s position that Iran and Hezbollah were responsible for the bombing and outlined the country’s new efforts to pursue justice—including trials in absentia.
“Those who commit acts of terror will find no refuge,” said Ambassador Gramuglia.
Just weeks earlier, on June 26, Argentine federal judge Daniel Rafecas formally ordered that ten people—including several former senior Iranian officials—stand trial in absentia for their alleged roles in the bombing.
Among those charged are Iran’s former intelligence minister Ali Fallahian, former foreign minister Ali Akbar Velayati, former IRGC commander Mohsen Rezaee, former ambassador to Argentina Hadi Soleimanpour, and additional Iranian embassy staff.
The defendants are considered fugitives, many since 2003, and will be tried under a new law passed in February allowing long-term fugitives to face justice even if absent from court.
Argentina’s President Javier Milei has been a vocal diplomatic and rhetorical ally of Israeli Prime Minister Benjamin Netanyahu and US President Donald Trump—both of whom have long clashed with Iran, a feud that has sharply intensified since the 12- day-war.
Argentina, home to Latin America’s largest Jewish community, has seen its case complicated over the years by allegations of cover-ups, shifting judicial leadership, and even political interference.
Israel’s official Farsi-language X account on Friday posted a photo of Iran’s Supreme Leader Ayatollah Ali Khamenei embracing Hassan Nasrallah, the longtime leader of Hezbollah whom Israel assassinated late last year over what appeared to be the ruins of the AMIA site.
"The perpetrators of this crime: one has been dispatched to hell, and the other is hiding in an underground hell," the post said, referring to reports that Iran's Supreme Leader was transferred to a bunker during the Israeli attacks.
Iran, however, has rejected the accusations as baseless.
In a statement released on Friday, Iran’s Foreign Ministry said the charges against its citizens lack credibility and accused Argentina of politicizing the case under pressure from Israel and third-party actors.
“Iran has called for the real masterminds and perpetrators of the explosion to be identified,” the statement read, adding that the Islamic Republic reserves the right to respond to “any inappropriate and unreasonable action” taken against its citizens.
Iran's ministry also criticized what it called a “show trial,” and urged Argentina to uphold principles of transparency, fairness, and independence in its judicial proceedings.
While Tehran continues to deny involvement, the panelists at the CIJA event argued that justice—though delayed—must not be denied.
For them, the AMIA bombing is more than a tragic memory. It is a warning about the enduring threat posed by the Iranian government—one they say must be confronted, in courtrooms, in policy, and in public awareness.
Secretary of Defense Pete Hegseth on Friday doubled down on assertions by the Trump administration that US attacks on three Iranian nuclear sites had obliterated Tehran's nuclear capabilities, saying the results were ever clearer.
"The more we report and the more we see, the more we understand how devastating those attacks were on all three of those nuclear sites," Hegseth told Pentagon pool reporters on Friday.
US attacks on June 22 hit Iran's nuclear sites of Fordow, Esfahan and Natanz.
Hegseth's remarks come after a report by NBC News on Thursday citing current and former US officials saying just one of the three nuclear facilities struck by the US in Iran last month has been destroyed.
That assessment, which showed that Fordow was set back as long as two years, was briefed to US lawmakers, Defense Department officials and allied countries in recent days.
An initial Pentagon assessment suggested the attacks had only set Iran's nuclear program back by months, but subsequent analysis released by the Central Intelligence Agency said it would take Tehran years to recover.
Trump on Wednesday said Iran's nuclear program had been dealt an irreparable blow by the US attacks and that he was in no rush to resume negotiations with Tehran despite its alleged eagerness.
