Ransomware attack on China’s ICBC disrupts treasury market trading

The logo of Industrial and Commercial Bank of China Ltd (ICBC) is seen at its branch in Beijing, China, 30 March 2016. REUTERS/Kim Kyung-Hoon/File Photo Acquire License Rights

Nov 9 (Reuters) – A ransomware attack on the Industrial and Commercial Bank of China (ICBC) disrupted some trading in the U.S. Treasury market on Thursday, but market sources said the impact appeared to be limited.

ICBC Financial Services said in a statement that a ransomware attack caused disruptions to certain systems and it was conducting an investigation and “advancing its recovery efforts.”

The bank said it successfully completed treasury operations conducted on Wednesday and repurchase financing (repo) operations conducted on Thursday.

“In general, the event had limited impact on the market,” said Scott Skrym, executive vice president of fixed income and repo at broker-dealer Curvature Securities.

In ransomware attacks, hackers encrypt a company’s systems and demand ransom payments in exchange for unlocking them. It was not immediately clear who was behind the attack.

While ransomware attacks have surged across a range of sectors in recent years, they have rarely disrupted a major financial market. Thursday’s incident is likely to raise questions about market participants’ cybersecurity controls and potentially trigger regulatory scrutiny.

Some market participants said trades cleared through ICBC, China’s largest commercial lender by assets, were not settled due to the attack, hurting market liquidity. It was unclear whether that contributed to the weak result of a 30-year bond auction on Thursday.

“There may have been some technical issues as some participants did not have full market access on the day,” said Michael Gladchun, associate portfolio manager, core plus fixed income, at Loomis Sayles.

The Financial Times reported earlier on Thursday that the US Securities Industry and Financial Markets Association (SIFMA) told its members that ICBC (601398.SS) was affected by ransomware that disrupted the US Treasury bond market by affecting them prevented players from transacting on behalf of other markets.

“We are aware of the cybersecurity issue and are in regular contact with key players in the financial sector, in addition to the federal regulators. We continue to monitor the situation,” a Treasury spokesperson said in response to a question about the FT report. SIFMA declined to comment.

The Treasury market appeared to be functioning normally on Thursday, according to LSEG data.

According to the data platform Statista, companies worldwide registered 493.33 million ransomware attack attempts last year. According to the Financial Services Information Sharing and Analysis Center, the Lockbit cybercriminal group was the most prolific ransomware operator in 2022.

Reporting by Urvi Dugar in Bengaluru and Pete Schroder in Washington; Additional reporting by Zeba Siddiqui and Gertrude Chavez, Davide Barbuscia, Carolina Mandl, Paritosh Bansal; Edited by Diane Craft and Stephen Coates

Our standards: The Thomson Reuters Trust Principles.

Purchase license rightsopens new tab

Covers financial regulation and policy from the Reuters Washington bureau, with a particular focus on banking regulators. Reporting on economic and financial policy in the US capital for 15 years. His previous experience includes roles at The Hill newspaper and The Wall Street Journal. Received a master’s degree in journalism from Georgetown University and a bachelor’s degree from the University of Notre Dame.