US Banks on Alert for Iran-Linked Cyber Threats Amid Conflict

Financial firms step up monitoring for potential DDoS attacks and focus on operational resilience to protect US capital markets.

Published on Mar. 4, 2026

Got story updates? Submit your updates here. ›

The U.S. financial services industry is on heightened alert for potential cyberattacks amid the unfolding U.S. war in Iran, with firms stepping up monitoring for threats that often rise during periods of geopolitical conflict. Iran-aligned hacktivists may conduct low-level cyberattacks like DDoS on U.S. networks, and financial firms are focusing on operational resilience to protect the integrity and stability of the U.S. capital markets.

Why it matters

The financial services industry operates critical U.S. infrastructure, including payments, clearing and settlement systems, as well as trading platforms and Treasury markets, making it a top target of cyberattacks. Heightened geopolitical tensions with Iran increase the risk of disruptive cyberattacks that could impact the stability and functioning of U.S. financial markets.

The details

According to a U.S. intelligence assessment, Iran-aligned 'hacktivists' could conduct low-level cyberattacks against U.S. networks, such as distributed denial-of-service (DDoS) attacks. The industry group SIFMA, which runs an annual exercise to ensure financial firms can operate through significant cyber emergencies, said the industry remains vigilant and ready to respond to cyber threats, with a focus on operational resilience. Credit rating agency Morningstar DBRS warned that Iran could increase its cyberattacks against Western entities, including banks, while investment bank Lazard's geopolitical advisory team flagged cyber risks, noting Iran's willingness to deploy cyber capabilities against commercial targets.

  • The killing of Iranian Supreme Leader Ali Khamenei last weekend sparked a conflagration in the Middle East.
  • In 2024, the financial services sector was the top target of DDoS attacks, with the Hamas-Israel and Russia-Ukraine wars fueling a surge in hacktivism.
  • In 2023, a ransomware attack on the U.S. broker-dealer unit of Industrial and Commercial Bank of China disrupted settlement of some U.S. Treasury trades.

The players

SIFMA

An industry group that runs an annual exercise to ensure financial firms can operate through significant cyber emergencies.

Morningstar DBRS

A credit rating agency that warned Iran could increase its cyberattacks against Western entities, including banks.

Lazard

An investment bank whose geopolitical advisory team flagged cyber risks, noting Iran's willingness to deploy cyber capabilities against commercial targets.

Got photos? Submit your photos here. ›

What’s next

According to the report, U.S. intelligence sees low-level cyberattacks as possible, and financial firms are focusing on operational resilience to protect the integrity and stability of the U.S. capital markets.

The takeaway

The heightened geopolitical tensions with Iran have increased the risk of disruptive cyberattacks on the U.S. financial services industry, which operates critical infrastructure. Financial firms are stepping up monitoring and focusing on operational resilience to protect the stability of the U.S. capital markets.