Public cyber incident analysis · 2026
Iranian banks: a recovery announcement is not proof of recovery
Three reports from June 2026 distinguish official statements, customer accounts and continuing disruption. They do not provide a complete forensic reconstruction.
Analysis of a public incident, not a CyberUP client reference. News reporting and analysis of communications.
At a glance
Dates alone do not establish recovery
Figures and dates come from the cited sources. They are not results from a CyberUP exercise.
The documented record
Facts and scope.
Different sources, different scopes
Reuters reported disruption to card-related services at Melli, Saderat and Tejarat, and referred to a 14 June incident affecting shared communications. Iran International reported customer accounts involving eight banks. The lists do not necessarily describe the same systems or the same point in time. [1] [2]
What the 30 June report adds
IranWire described more than two weeks of disruption, including difficulties with transfers, salaries and payments. It named Melli, Saderat, Tejarat and the Export Development Bank of Iran. This is reporting on service continuity, not technical proof that all effects shared a single cause. [3]
Key dates
The documented timeline.
The evidence is a usable service, not an announcement
This case raises a governance question: what evidence supports moving from “recovery expected” to “recovery verified”? We propose observing that transition in a simulation, keeping an estimated completion time separate from confirmed service availability.
For a bank, the exercise could distinguish the channel, transaction type and affected population. This is an exercise proposal, not a reconstruction of tests performed by the banks discussed. Reopening a channel does not automatically resolve questions about stability, backlogs or whether a transaction can be completed.
When customer reports conflict with supplier updates, the team needs to record the discrepancy without prematurely choosing a definitive account. Coordination should establish who verifies the evidence, which checks are sufficient and what wording to use in the meantime.
The lesson also applies to source handling: official communications, customer experience and technical analysis provide different kinds of evidence. A table that merges them into one apparently certain timeline may look orderly while concealing the uncertainty that leadership needs to manage.
From incident analysis to readiness
Three questions to test.
Exercise ideas for your organisation. They do not describe work carried out by CyberUP for the organisation discussed.
What evidence closes an outage status?
Define the transactions to verify and who accepts the results. Keep the supplier’s estimate separate from the outcome of the checks.
How do we handle a conflicting report?
Provide a channel for collecting and checking customer evidence. Keep observations distinct from assumptions about the cause.
Who corrects an outdated announcement?
Establish who updates messages and how corrections remain traceable. Do not present an earlier forecast as an achieved result.
Source record
Sources and further reading.
Source dates and the period covered are distinct from this page’s source-review date. CyberUP interpretations are labelled as such. External sources do not imply endorsement or a commercial relationship.
- Reuters · 23 June 2026
Iran says card-based banking hit by cyberattack on three lenders (opens in a new tab)
Reuters — the same dispatch republished by WSAU (opens in a new tab)Reporting of official statements. Reuters cites ISC and the central bank. The forecast for 24 June is not verification of recovery. - Iran International · 23 June 2026
Banking disruption hits services at eight Iranian banks (opens in a new tab)News reporting · customer accounts. Reports of unavailable services, with a different scope from ISC’s technical account. - IranWire · 30 June 2026
Major Cybersecurity Failure: Four Largest Iranian Banks Face 3rd Week of Outages (opens in a new tab)News reporting. Continuing disruption described on 30 June. Not a forensic report on the two incidents.