Overview:
Bank Sepah is an Iranian state-owned bank serving millions of customers, making it a critical component of Iran's financial infrastructure and a high-value target for both financial gain and geopolitical messaging.
What Happened:
The hacker collective "Codebreakers" breached Bank Sepah's systems, stealing approximately 12 terabytes of data containing 42 million customer records, including detailed information about senior bank officials and high-ranking military personnel. The attackers demanded a $42 million Bitcoin ransom.
Business Impact:
- Financial Loss: Estimated $85 million in system recovery and customer protection measures
- Downtime: 45 days for core banking operations restoration
- Reputational/Legal Effects: Complete loss of customer confidence, government investigation, international banking restrictions
Response & Recovery:
- Detection Time: 72 hours after initial compromise
- Recovery Actions: Complete system rebuild, enhanced security protocols, customer identity protection program
- Duration of Impact: 6 weeks operational disruption, ongoing geopolitical consequences
Key Takeaways:
- Financial institutions remain prime targets for both financial and political motivations
- Ransom demands matching the number of affected records suggests sophisticated threat actor organization
- State-owned entities face additional risks from nation-state adversaries seeking geopolitical leverage