US Banks Brace for Cyberattacks Amid Escalating Iran Conflict

• Financial services was the top target of DDoS attacks in 2024, with geopolitical conflicts like Hamas-Israel and Russia-Ukraine wars fueling a surge in hacktivism, according to FS-ISAC.
• U.S. intelligence warns Iran-aligned 'hacktivists' could launch distributed denial-of-service (DDoS) attacks that overwhelm targeted servers with internet traffic.
• Credit rating agency Morningstar DBRS and investment bank Lazard both flagged elevated cyber risks, noting Iran's demonstrated willingness to deploy cyber capabilities against commercial targets including financial systems.

Summary: US Banks Brace for Cyberattacks Amid Escalating Iran Conflict

Key Developments:

The U.S. financial services sector is on heightened alert for potential cyberattacks following the killing of Iranian Supreme Leader Ali Khamenei in a weekend airstrike. Banks and financial institutions have intensified monitoring efforts as geopolitical tensions escalate.

Primary Threats:

U.S. intelligence assessments indicate Iran-aligned "hacktivists" could launch low-level cyberattacks, particularly distributed denial-of-service (DDoS) attacks that overwhelm servers with internet traffic. According to a 2025 FS-ISAC report, the financial services sector was the top target of DDoS attacks in 2024, with geopolitical conflicts fueling increased hacktivism.

Sector Vulnerability:

The financial services industry operates critical U.S. infrastructure including payments, clearing and settlement systems, trading platforms, and Treasury markets, making it a prime target. Todd Klessman of SIFMA emphasized the industry's focus on "operational resilience, which is foundational to the integrity and stability of U.S. capital markets."

Credit Rating Perspective:

Morningstar DBRS warned that while indirect risks like sustained higher oil prices pose significant threats to global banks and asset managers, cyber risks are also elevated. Lazard's geopolitical advisory team noted Iran's history of deploying cyber capabilities against commercial targets, including financial systems.

Historical Context:

While no major disruption from hostile attacks has occurred in recent memory, smaller incidents have impacted the market. A 2023 ransomware attack on ICBC's U.S. broker-dealer unit disrupted some Treasury trades, demonstrating the sector's vulnerability.

Market Implications:

Heightened cybersecurity concerns add operational risk to an already volatile geopolitical environment, potentially affecting market stability and investor confidence.