I think this was done by Iran and the Quds Force, which has its own developing cyber attack capacity. And I believe it was in response to the increasingly strong economic sanctions that the United States and our European allies have put on Iranian financial institutions.
The nature of this attack is sophisticated enough or large enough that even the largest of the financial institutions would find it difficult to defend against.