U.S. banks and financial institutions are on heightened alert for cyberattacks as the war involving Iran escalates, prompting concerns that digital retaliation could target critical financial infrastructure.

The killing of Iranian Supreme Leader Ali Khamenei in a recent airstrike has intensified instability across the Middle East, roiling global markets and increasing fears that Iran-linked actors could shift conflict into cyberspace. Financial services executives and analysts say firms are stepping up monitoring, reviewing contingency plans, and reinforcing system defenses.

Financial Infrastructure a Prime Target

The U.S. financial system operates essential infrastructure, including payment rails, clearing and settlement systems, trading platforms, and Treasury markets. Because of this central role, it has long been viewed as a high-value target during periods of geopolitical conflict.

Industry group SIFMA, which conducts annual crisis simulations to test systemic resilience, emphasized that firms remain vigilant. Operational continuity has become a foundational priority for maintaining capital market stability.

A senior banking official noted that lenders are especially concerned about cyber risks in the current environment, viewing attacks as plausible rather than hypothetical.

Low-Level Attacks Seen as Likely

According to U.S. intelligence assessments, Iran-aligned “hacktivist” groups could conduct lower-level attacks against U.S. networks. These may include distributed denial-of-service (DDoS) campaigns, where attackers flood systems with traffic to disrupt access rather than cause permanent damage.

DDoS incidents are not uncommon during global conflicts. A 2025 report from Financial Services Information Sharing and Analysis Center found that the financial services industry was the top target of DDoS attacks in 2024, fueled in part by geopolitical flashpoints including the Hamas-Israel and Russia-Ukraine conflicts.

While such attacks typically aim to disrupt operations temporarily rather than compromise core systems, they can still create reputational and operational stress.

Indirect Risks Also Loom

Beyond direct cyber threats, ratings agency Morningstar DBRS warned that global banks face indirect risks from prolonged conflict, including sustained high oil prices and economic shocks affecting borrowers.

Investment bank Lazard also flagged cyber risks in its geopolitical advisory analysis, noting Iran’s prior willingness to deploy cyber capabilities against commercial and financial targets.

The industry has so far avoided large-scale systemic disruptions from hostile cyber campaigns. However, localized incidents have occurred. In 2023, a ransomware attack on the U.S. broker-dealer unit of Industrial and Commercial Bank of China disrupted settlement of some U.S. Treasury trades, highlighting the vulnerability of even well-defended institutions.

Resilience Under the Microscope

Today’s elevated alert posture reflects years of regulatory and industry investment in cybersecurity defenses, threat-sharing protocols, and incident response planning. Banks conduct regular stress simulations to ensure they can maintain operations even if individual systems are compromised.

Still, as geopolitical tensions rise, cyber conflict remains an unpredictable variable. Even low-level disruptions can amplify market volatility during already fragile periods.

For now, financial institutions appear focused on vigilance, coordination, and ensuring that critical systems remain operational under pressure.