Ransomware Attack on China’s ICBC Disrupts Treasury Market Trading

Nov 9 (Reuters) – A U.S. Treasury note disrupted some trading on Thursday, but the impact was limited, market sources said.

ICBC Financial Services said in a statement that the ransomware attack had disrupted some systems and that it was conducting an investigation and “advancing its recovery efforts”.

The bank said the treasury trades executed on Wednesday and the repurchase agreements (repo) executed on Thursday have successfully completed the financial trades.

“In general, this event had a minimal impact on the market,” said Scott Schrim, executive vice president of fixed income and repos at broker-dealer Curvature Securities.

In ransomware attacks, hackers encrypt a company’s systems and demand a ransom in exchange for unlocking them. It was not immediately clear who was behind the attack.

Bloomberg reported later Thursday that a major criminal group known as Lockbit with ties to Russia was suspected of masterminding the hack, citing people familiar with the situation.

While ransomware attacks have been on the rise in various sectors in recent years, they have rarely disrupted a major financial market. Thursday’s incident raises questions about market participants’ cybersecurity controls and could subject them to regulatory scrutiny.

Some market participants said trades through ICBC, China’s largest commercial lender by assets, were not settled because of the attack, affecting market liquidity. It’s unclear whether that contributed to the weak outcome of Thursday’s 30-year bond auction.

“There may have been some technical issues that prevented some participants from fully accessing the market that day,” said Michael Klatshun, associate portfolio manager for core plus fixed income at Loomis Sayles.

The Financial Times earlier on Thursday told members of the U.S. Securities Industry and Financial Markets Association (SIFMA) that ICBC ( 601398.SS ) had been affected by ransomware, which disrupted trading on behalf of other markets and disrupted the U.S. Treasury market. Players.

“We are aware of the cyber security issue and are in regular contact with key financial sector participants in addition to federal regulators. We continue to monitor the situation,” a Treasury spokesperson said in response to a question about the FT report. SIFMA declined to comment.

According to LSEG data, the Treasury market appeared to be performing normally on Thursday.

According to data site Statista, global organizations detected 493.33 million ransomware attack attempts last year. According to the Financial Services Information Sharing and Analysis Center, Lockbit was the dominant ransomware operator throughout 2022.

Our Standards: Thomson Reuters Trust Principles.