Codebreakers attack on Bank Sepah

The Codebreakers attack on Iranian Bank Sepah was a major cyber intrusion publicly disclosed in March 2025. A hacker collective known as "Codebreakers" claimed responsibility for breaching Sepah Bank, one of Iran's oldest and most strategically significant financial institutions. The group alleged it had accessed over 42 million customer records, including sensitive financial data. The incident followed the IRLeaks attack in 2024, and the cyber attack on the Melli Bank in 2021, and as a result the vulnerabilities of Iran's financial infrastructure were exposed, causing widespread criticism against the bank and its affluent customers from the military and government sectors.

The bank initially responded with a complete denial of the breach, while simultaneously issuing warnings to local media against publishing the leaked data and threatening with legal prosecution. The hacker group responded with partial exposure of the leaked information, including the financial data of senior Iranian officials and IRGC officers with billions of Iranian Tomans in their accounts. Contrasted with the rampant poverty in Iran, the incident triggered widespread criticism in social media against the officials and the regime, and the manner in which the bank addressed the incident was mocked.

Background

Bank Sepah, established in 1925, is Iran's oldest national bank still in operation and is the fourth largest state-owned bank in the country. It has over 1700 branches in Iran and three additional branches in Rome, Paris and Frankfurt, and a wholly-owned subsidiary in London. Bank Sepah was originally founded to provide financial services to military personnel, and in 2020 a number of military banks were merged into it as part of a broader restructuring program to consolidate all military financial institutions under one state-run entity. It has long played a central role in financing military and defense-related projects, particularly Iran's pursuit of missiles and weapons of mass destruction, facilitating numerous transactions for the procurement of missile components from China and from Korea Mining and Development Trading Corporation (KOMID), North Korea's primary ballistic missile exporter. As a result, the bank has been under US, EU, and UN sanctions due to its involvement in proliferating weapons of mass destruction technologies, including support to entities such as Iran's Aerospace Industries Organization (AIO) which oversees all of Iran's missile industries, Shahid Hemmat Industrial Group (SHIG), responsible for Iran's ballistic missile program and Shahid Bakeri Industries Group (SBIG) involved in the development of missile systems capable of carrying chemical warheads. The 2025 cyber attack on the Bank Sepah follows other similar attacks, such as the 2024 IRLeaks attack, for which the Iranian government paid millions of dollars in ransom to prevent the release of customer data, and the 2021 attack on Melli Bank which resulted in the failure to prevent data exposure.

The breach

In early March 2025, the hacker group Codebreakers posted a message on Telegram and other social platforms claiming they had infiltrated Bank Sepah's systems and extracted vast amounts of data. They alleged access to more than 12 terabytes of confidential data belonging to more than 42 million individuals, including account numbers, passwords, mobile phone numbers, residential addresses, bank transaction histories, and information related to military personnel. The group stated that they had offered the bank a 72-hour window for negotiations to prevent the disclosure of the information, with the demand of $42 million in Bitcoin, which the bank refused to pay.

Official denial and social media response

Initially Sepah Bank denied all claims that its security systems had been breached, as head of the Bank’s Public Relations Department Reza Hamedanchi stated that the bank's systems worked on closed networks with no connection to the internet, and that "Sepah Bank’s systems are unhackable and impenetrable”. However, the bank warned media and citizens against republishing the information obtained by the hackers and threatened with legal action against those who did. The threats were issued due to the bank's "position with the armed forces" and the importance of "confidentiality of information related to the country's military and security institutions".

In response to the bank's denial and its "indifference to the security breach", the Codebreakers group released images of the banking data belonging to head of public relations at Bank Sepah, Reza Hamedanchi, as well as the private banking data of 20 thousand individuals, including high-profile civilian and military customers. Among those whose private information and account details were exposed are Abbas Golmohammadi, former Deputy Director of Exploration at the Geological and Mineral Exploration Organization of the country and Deputy Director of Planning and Development of the Sangan Iron Ore Complex, with an account of 768 billion Tomans, General Hassan Palarak, former senior commander of the Revolutionary Guards Quds force, a supporter of pro-Islamic Republic militias in the region and a close associate of Qassem Soleimani, with a value of 634 billion tomans ($6.12M at the open market rate), Alireza Arash, a member of the board of directors of Henkel Pakwash, a subsidiary of the German multinational chemical company Henkel, with an account of 408 billion Tomans. Other notable individuals whose details were exposed are Mohammad Baradaran, a board member of Ghadir Investment Company, Kazem Ghalamchi, founder of Ghalamchi Educational Institute and Rasoul Sirati, CEO of Tik, a military affiliate company reportedly involved in missile and drone technology.

The leaked information and the bank's response to the attack triggered a wave of criticism online, with Iranian citizens raising questions on how such large sums of money can be held by only a few individuals, while the general public struggles with financial difficulties. Ali Sharifizarchi, an academic with a large following on Twitter/X, focussed particularly on Palarak, questioning how his wealth is justified in light of the widespread economic crisis. Investigative journalist Yashar Soltani stated that the exposed data explains why Iranian citizens support the sanctions against Iran and demand financial transparency. Conservative journalist Ali Gholhaki, as well as other users of social media, have mocked the bank for threatening legal action while simultaneously denying there had been any data breach.

See also

• Bank Sepah
• IRLeaks attack on Iranian banks
• Iranian cyberwarfare
• Sanctions against Iran
• Banking and insurance in Iran
• List of cyberattacks