Iran Pays Millions in Ransom to End Cyberattack on Banks

Iranians at a bank branch in Tehran (IRNA)
Iranians at a bank branch in Tehran (IRNA)
TT

Iran Pays Millions in Ransom to End Cyberattack on Banks

Iranians at a bank branch in Tehran (IRNA)
Iranians at a bank branch in Tehran (IRNA)

A massive cyberattack that hit Iran last month threatened the stability of its banking system and forced the country's regime to agree to a ransom deal of millions of dollars, POLITICO reported on Thursday.

The newspaper said an Iranian firm paid at least $3 million in ransom last month to stop an anonymous group of hackers from releasing individual account data from as many as 20 domestic banks in what appears to be the worst cyberattack the country has seen, quoting industry analysts and western officials briefed on the matter.

A group known as IRLeaks, which has a history of hacking Iranian companies, was likely behind the breach, the officials said.

The hackers are said to have initially threatened to sell the data they collected, which included the personal account and credit card data of millions of Iranians, on the dark web unless they received $10 million in cryptocurrency, but later settled on a smaller sum.

Iran’s authoritarian regime pushed for a deal, fearing that word of the data theft would destabilize the country’s already-wobbly financial system, which is under intense strain amid the international sanctions the country faces, the officials said.

Iran never acknowledged the mid-August breach, which forced banks to shut down cash machines across the country.

IRleaks entered the banks’ servers via a company called Tosan, which provides data and other digital services to Iran’s financial sector, the officials said.

Using Tosan, the hackers appear to have siphoned data from both private banks and Iran’s central bank. Of Iran’s 29 active credit institutions, as many as 20 were hit, including the Bank of Industry and Mines and the Post Bank of Iran.

Though the attack was reported at the time by Iran International, an opposition news outlet, neither the suspected hackers nor the ransom demands were disclosed.

Iran’s supreme leader delivered a cryptic message in the wake of the attack, blaming the US and Israel for “spreading fear among our people,” without acknowledging the country’s banks were under assault.

Despite the growing tensions between Iran and both the US and Israel, people familiar with the Iranian banking hack told POLITICO that IRLeaks is affiliated with neither the US nor Israel.



30 Passengers Evacuate after Cruise Ship Runs Aground on a Reef in Fiji

An aerial view shows the sunset behind Namatakula village, Coral Coast, Fiji July 9, 2022. REUTERS/Jill Gralow
An aerial view shows the sunset behind Namatakula village, Coral Coast, Fiji July 9, 2022. REUTERS/Jill Gralow
TT

30 Passengers Evacuate after Cruise Ship Runs Aground on a Reef in Fiji

An aerial view shows the sunset behind Namatakula village, Coral Coast, Fiji July 9, 2022. REUTERS/Jill Gralow
An aerial view shows the sunset behind Namatakula village, Coral Coast, Fiji July 9, 2022. REUTERS/Jill Gralow

Thirty passengers were evacuated from a cruise ship that ran aground on a reef in Fiji, the ship’s owner said Monday.

The MV Fiji Princess, operated by Blue Lagoon Cruises, ran aground Saturday near Monuriki Island, scene of the 2000 movie starring Tom Hanks “Cast Away,” The Associated Press quoted the Fiji-based tourism company as saying in a statement.

“Whilst the investigation is in its early stages, conditions upon the ship anchoring in the area were calm, and it appears a severe squall caused the ship’s anchor to drag towards a nearby reef whereby the ship became grounded,” the statement said.

A ferry was brought alongside the 55.52-meter (182-foot) ship at first light on Sunday and 30 passengers disembarked with their luggage and belongings. No one was injured.

The passengers were taken to Denarau Island.

Blue Lagoon Cruises said pumpable fuel as well as other oils stored onboard the ship had been removed by Monday, diminishing environmental risks.

A salvage specialist from Australia had been on the scene since Sunday overseeing recovery efforts, the statement said.

The Maritime Safety Authority of Fiji, an industry regulator, did not respond to a request for comment Monday.


High-Stakes US Mission in Zagros Highlands Rescues F-15 Airman from Iran

In this image provided by Sepahnews, the Iranian Revolutionary Guard's official website, wreckage is shown at what Iran's state TV claimed was the site of a downed American transport plane and two helicopters involved in a rescue operation, in Isfahan province, Iran, April 2026. (Sepahnews via AP)
In this image provided by Sepahnews, the Iranian Revolutionary Guard's official website, wreckage is shown at what Iran's state TV claimed was the site of a downed American transport plane and two helicopters involved in a rescue operation, in Isfahan province, Iran, April 2026. (Sepahnews via AP)
TT

High-Stakes US Mission in Zagros Highlands Rescues F-15 Airman from Iran

In this image provided by Sepahnews, the Iranian Revolutionary Guard's official website, wreckage is shown at what Iran's state TV claimed was the site of a downed American transport plane and two helicopters involved in a rescue operation, in Isfahan province, Iran, April 2026. (Sepahnews via AP)
In this image provided by Sepahnews, the Iranian Revolutionary Guard's official website, wreckage is shown at what Iran's state TV claimed was the site of a downed American transport plane and two helicopters involved in a rescue operation, in Isfahan province, Iran, April 2026. (Sepahnews via AP)

US President Donald Trump on Sunday said US forces had safely recovered a second colonel — part of the crew of a downed F-15E Strike Eagle in Iran — concluding a 36-hour rescue operation in the middle of the Zagros highlands that involved dozens of aircraft and hundreds of special operations forces, according to US officials and informed sources.

“The United States Military pulled off one of the most daring Search and Rescue Operations in US History, for one of our incredible Crew Member Officers, who also happens to be a highly respected Colonel, and who I am thrilled to let you know is now SAFE and SOUND!” Trump said on Truth Social.

“He sustained injuries, but he will be just fine,” he added.

Trump said at his direction, the US Military sent dozens of aircraft, armed with the most lethal weapons in the world, to retrieve him.

“This miraculous Search and Rescue Operation comes in addition to a successful rescue of another brave Pilot, yesterday, which we did not confirm, because we did not want to jeopardize our second rescue operation,” he said.

The injured officer was rescued following two days of risky operations, after the officer’s F-15E Strike Eagle was shot down during a night mission in southwestern Iran.

The first crew member was rescued on Friday by two Blackhawk helicopters that were hit by Iranian fire but made it out of Iranian airspace, two US officials told Reuters.

In a separate incident, an A10 Warthog fighter aircraft was hit and crashed over the Arabian Gulf, with the pilot ejecting, the officials said. The degree of any injuries among the crew of the aircraft remained unclear.

The governor of Iran’s Kohgiluyeh and Boyer-Ahmad province said anyone who captured or killed the crew “would be specially commended,” Iran's semi-official news agency ISNA reported.

Two-day race

The rescue followed a life-or-death race between US and Iranian forces to reach the airman, a weapons system officer, that stretched over two days, officials told The New York Times on Sunday.

Navy SEAL Team 6 commandos rescued the weapons systems officer in an operation that involved hundreds of special operations troops and other military personnel working deep in enemy territory, current and former US officials said.

After ejecting from the F-15E, the officer hid in a mountain crevice. His location was initially unknown to the United States, but US officials found his hiding place via a beacon he was carrying.

The CIA also initiated a deception campaign to try to confuse Iranian forces and convince them the airman had already been rescued and was moving out of the country in a ground convoy.

After confirming the airman’s identity and that he was alone, senior military officials waited until dark to launch a rescue mission, which included Special Operations helicopters loaded with commandos.

US aircraft dropped bombs and opened fire on Iranian convoys to keep them away from where the airman was hiding. US commandos also opened fire to keep Iranian forces away from the rescue site as they converged on the airman.

But they did not engage in a firefight with enemy forces. US officials described the territory where the airman was hiding as strongly opposed to the Iranian regime and said it was unclear how close Iranian forces ever got to the site.

Planes destroyed

The airman was taken by helicopter to a sandy, austere airstrip inside Iran that Special Operations forces had previously developed for possible rescues or other contingencies.

The plan was to immediately load the airman and the rescue force onto two C-130 aircraft that were supposed to carry them out of danger to an airfield in Kuwait. But, in a final twist, the nose gear of at least one, and possibly both, of those planes got stuck in the sandy dirt at the airstrip, military officials said.

Hours passed. Efforts to free the stuck wheels failed, so the commandos called in three replacement aircraft.

Officials in the Pentagon and at Central Command waited anxiously. The success of a dangerous mission, which had seemed nearly complete, was suddenly once again uncertain.

Eventually the commandos and the injured weapons system operator were reloaded onto three newly arrived replacement aircraft. After the rescue team left, American warplanes bombed the two disabled planes rather than let them fall into Iranian hands.

As the sun was rising, the three planes launched in succession from the remote airstrip. The plane carrying the rescued airman went first followed by the others.

“The fact that we were able to pull off both of these operations, without a SINGLE American killed, or even wounded, just proves once again, that we have achieved overwhelming Air Dominance and Superiority over the Iranian skies,” Trump said on social media.

Iran’s version

In return, Iran's military claimed the US operation was “completely foiled.”

Iranian military spokesman Ebrahim Zolfaghari told state media US forces had used an abandoned airport in southern Isfahan province, which lies to the northwest of the area where the airman ejected.

He said the aircraft had been taking part in “a deception and escape mission... under the pretext of recovering the pilot of a downed aircraft.

Iranian state media broadcast images of the charred wreckage of what appears to be a plane in a desert area, while officials claimed that two C-130 military transport planes and two Black Hawk helicopters had been destroyed.

In the footage, two charred propellers and engines can be clearly seen, with specialized open-source geolocating experts claiming the images were taken about 50 kilometers (30 miles) south of the city of Isfahan.

Iran’s Speaker of Parliament Mohammad Ghalibaf said: “If the United States gets three more victories like this, it will be utterly ruined.”


Airstrikes on Iran Kill More Than 25 as Trump's Deadline to Open Strait of Hormuz Looms

16 March 2026, Undisclosed location: A US Navy EA-18G Growler electronic warfare aircraft, assigned to the 'Wizards' of Electronic Attack Squadron 133, is signaled to hold for launch on the flight deck of the USS Abraham Lincoln during Operation Epic Fury on March 7, 2026. Photo: Navy /U.S. Navy/Planet Pix via ZUMA Press Wire/dpa
16 March 2026, Undisclosed location: A US Navy EA-18G Growler electronic warfare aircraft, assigned to the 'Wizards' of Electronic Attack Squadron 133, is signaled to hold for launch on the flight deck of the USS Abraham Lincoln during Operation Epic Fury on March 7, 2026. Photo: Navy /U.S. Navy/Planet Pix via ZUMA Press Wire/dpa
TT

Airstrikes on Iran Kill More Than 25 as Trump's Deadline to Open Strait of Hormuz Looms

16 March 2026, Undisclosed location: A US Navy EA-18G Growler electronic warfare aircraft, assigned to the 'Wizards' of Electronic Attack Squadron 133, is signaled to hold for launch on the flight deck of the USS Abraham Lincoln during Operation Epic Fury on March 7, 2026. Photo: Navy /U.S. Navy/Planet Pix via ZUMA Press Wire/dpa
16 March 2026, Undisclosed location: A US Navy EA-18G Growler electronic warfare aircraft, assigned to the 'Wizards' of Electronic Attack Squadron 133, is signaled to hold for launch on the flight deck of the USS Abraham Lincoln during Operation Epic Fury on March 7, 2026. Photo: Navy /U.S. Navy/Planet Pix via ZUMA Press Wire/dpa

Israel and the United States carried a wave of attacks Monday that killed more than 25 people in Iran. Tehran responded with missile fire on Israel and its Gulf Arab neighbors as US President Donald Trump’s deadline for Tehran to reopen the Strait of Hormuz loomed.

Explosions rang out into the night in Tehran and low-flying jets could be heard for hours as the capital was pounded. Thick black smoke rose near the city's Azadi Square after one airstrike hit the Sharif University of Technology grounds.

Two people were found dead in the rubble of a residential building in Haifa, according to Israeli authorities. The search was ongoing for two more even as new Iranian missile attacks hit the northern Israel city early Monday.

Kuwait and the United Arab Emirates both activated their air defense systems to intercept incoming Iranian missiles and drones, as Tehran kept up the pressure on its Gulf neighbors. Iran's regular attacks on regional energy infrastructure and its stranglehold on the Strait of Hormuz, through which a fifth of the world's oil is shipped in peacetime, has sent global energy prices soaring.

Under pressure at home as consumers are growing increasingly concerned, Trump gave Tehran a deadline that expires Monday night, Washington time, saying if no deal was reached to reopen the strait the US would hit Iran's power plants and other infrastructure targets and set the country “back to the stone ages.”

“Tuesday will be Power Plant Day, and Bridge Day, all wrapped up in one, in Iran,” he threatened in a social media post, adding that if Iran did not open the strait “you'll be living in Hell.”

Trump's deadline to open Hormuz strait looms but no signs of Tehran backing off Tehran has shown no signs of backing down off of its stranglehold on shipping through the strait, which was fully open before Israel and the US attacked Iran on Feb. 28 to start the war.

Following Trump’s expletive-laced posts on Easter Sunday, Iran’s parliamentary speaker Mohammad Bagher Qalibaf called the threats of targeting Iran’s infrastructure “reckless.”

“You won’t gain anything through war crimes,” Qalibaf wrote on X. “The only real solution is respecting the rights of the Iranian people and ending this dangerous game.”

Brent crude oil, the international standard, rose to $109 in early Monday spot trading, some 50% higher than it was when the war started.

Iran has let some vessels through the strait since the war began, but none belonging to the US, Israel or countries perceived as helping them. Some have paid Iran for passage and the overall flow of traffic is down more than 90% over the same period last year.

Beyond Trump's military threats, diplomatic efforts are still underway to see if a solution can be reached to open the waterway.

Oman’s Foreign Ministry said that deputy foreign ministers and experts from Iran and Oman met to discuss proposals to ensure “smooth transit” through the strait.

Egypt said that Foreign Minister Badr Abdelatty had spoken with US envoy Steve Witkoff and Iranian Foreign Minister Abbas Araghchi, and with Turkish and Pakistani counterparts. Russia said that Araghchi also spoke with Russian Foreign Minister Sergey Lavrov.

Airstrikes kill more than 25 across Iran

One of Monday's morning airstrikes targeted Tehran's Sharif University of Technology, where Iranian media reported damage to the buildings as well as a natural gas distribution site next to the campus.

It wasn’t immediately clear what had been targeted on the grounds of the university, which is empty of students as the war has forced all schools into the country into online classes. However, multiple countries over the years have sanctioned the university for its work with the military, particularly on Iran’s ballistic missile program, which is controlled by the country’s paramilitary Revolutionary Guard.

A strike near Eslamshar, southwest of Tehran, killed at least 13 people, the semiofficial Fars news agency reported. Five others were killed when a residential area in the city of Qom was hit, and six more were killed in strikes on other cities, the state-run IRAN daily newspaper reported.

Three more people were killed when an airstrike hit a home in Tehran, Iranian state television reported.

War's death toll in the thousands

More than 1,900 people have been killed in Iran since the war began, but its government has not updated the toll for days.

In Lebanon, which Israel has invaded by ground, more than 1,400 people have been killed and more than 1 million people have been displaced. Eleven Israeli soldiers have died there while targeting Iranian-backed Hezbollah militants.

In Gulf Arab states and the occupied West Bank, more than two dozen people have died, while 19 have been reported dead in Israel and 13 US service members have been killed.