Bank executives in Iran warn that shared data centers amplify cyber risk

Bank executives in Iran warned Tuesday that concentrating several lenders’ operations at the same data center site could let one attack disrupt multiple banks. The chair of Tejarat Bank said four major banks had already been moved to a single site.

Morteza Tork Tabrizi, who chairs Tejarat Bank’s board, told a Nov. 3 panel on keeping financial services running during crises that Iran had put too much emphasis on centralizing bank infrastructure despite facing sanctions and recurring threats. He said security restrictions had left private providers little room to help.

Tork Tabrizi said deputies from all four banks had been summoned to court. He said the banking sector had yet to recover from an earlier blow but was already considering putting banks together at one site again. He also said authorities had underestimated how much disruption cyberattacks could cause across the country.

Two data centers down in 17 minutes, executive says

Majid Ghayouri Sales, who chairs Parsian Bank’s data processing holding company, said an attack had disabled two data centers in 17 minutes. He recalled drives becoming unusable, with many registering as dead. Before the June 2025 war between Iran and Israel, he said, few would have expected an attack to take a data center out of service that way.

Ghayouri Sales also said a missile targeted a Bank Sepah data center 20 minutes after salaries were paid to members of the armed forces. He gave the examples separately. His account did not identify who carried out either attack. He said banks needed to settle who would be answerable in a crisis, a question he argued could not be left to technical teams alone.

What banks want from outside providers

Tork Tabrizi said he saw some willingness to move services outside the banks, but providers such as Asiatech would need to show what they could offer. Ghayouri Sales said lower prices alone would do little to persuade banks. He said they cared more about service quality, reliable support and who would take responsibility if something went wrong.

Masoud Vakilinia, CEO and a board member of Tafta, Tejarat Bank’s technology holding company, said banks had the resources to keep services in-house and were used to controlling their own infrastructure. He cited legal requirements as another barrier, though he said banks could push for changes if the conditions were right.

Mohammad Babaei, a vice president for data transmission at Asiatech, said private providers now had capabilities they might not have had a decade ago. He said he hoped banks would reconsider using them and argued that Asiatech’s service model could cost substantially less.