Major Iranian IT vendor paying large ransom to resolve recent cyberattack

An apparent cyberattack on Iranian IT provider Tosan — which serves roughly 45% of Iran’s banks and millions of customers — resulted in exfiltration of customer personal and transaction data affecting at least 20 financial institutions; the extortion group IRLeaks claimed responsibility, negotiated with Tosan, and received multiple Bitcoin payments while threatening to sell the data. CyberScoop reviewed emails and blockchain records showing partial ransom payments and ongoing wallet activity, even as Iranian authorities publicly denied a breach, raising significant risks to banking customers and national financial infrastructure.