ICBC Ransomware Attack Causes Disruption in US Treasury Market Trades

An attack by ransomware on China’s largest bank has caused disruption in the US Treasury market, forcing clients of the Industrial and Commercial Bank of China to redirect trades, as reported by market participants on Thursday.

The Securities Industry and Financial Markets Association informed members that ICBC had fallen victim to ransomware software, which essentially freezes computer systems until a payment is made, according to multiple sources familiar with the matter.

The attack led to ICBC being unable to settle Treasury trades for other market participants, prompting traders and banks to reroute trades. However, they noted that the effect on the overall functioning of the Treasury market appeared to be limited.

As of Thursday afternoon, ICBC had begun the process of restoring services, according to individuals briefed on the incident.

“The firm has assured people that they are working diligently to resolve US Treasuries transactions as quickly as possible,” said a source familiar with the situation.

A spokesperson from the Treasury department stated, “We are aware of the cybersecurity issue and are in regular contact with key financial sector participants, as well as federal regulators. We continue to monitor the situation.”

“This is a significant issue for the Fixed Income Clearing Corporation, so it is certainly a major concern and potentially impacting US Treasuries liquidity,” said an executive at a large bank that handles US Treasuries clearing.

ICBC did not immediately respond to a request for comment.

Ransomware attacks have become more prevalent since the onset of the pandemic, partly due to the increased vulnerability of businesses from remote work and the heightened organization of cyber criminal groups.

However, Allan Liska, a threat intelligence analyst at Recorded Future, noted that it was “extremely unusual for a bank of their size to be impacted like this”, emphasizing that the financial sector invests more in cybersecurity than any other industry.

Earlier on Thursday, “magic circle” law firm Allen & Overy experienced a ransomware attack on its servers and announced that it was investigating the impact and informing affected clients.

This is a developing story