Hacker attack on China’s largest bank disrupts US bond market – 11/09/2023 – Market

A ransomware attack on the financial services arm of ICBC, China’s largest bank, has disrupted the treasury market, forcing its customers to redirect trades, market players said on Thursday (9). .

The Securities Industry and Financial Markets Association first informed agents on Wednesday that ICBC Financial Services had been hit by ransomware, a virus that paralyzes systems until a payment is made, people familiar with the discussions said.

The attack prevented ICBC FS from clearing treasury trades on behalf of other market participants, according to investors and banks, with some equity trades also affected.

Market players, including hedge funds and asset managers, redirected trades due to the outage and the attack had little effect on U.S. Treasury market liquidity, according to industry sources, but did not harm the overall functioning of the market.

The bank said in a statement that it has already contained the cyber attack.

A notice on the ICBC FS website on Thursday evening (9) confirmed that the bank had “suffered a ransomware attack that resulted in the disruption of certain financial services systems” from Wednesday.

ICBC FS had contained the incident by disconnecting and isolating affected systems, the statement said, adding that it was “conducting a thorough investigation and progressing its recovery efforts” with the help of information security experts.

The bank successfully settled U.S. treasury trades executed on Wednesday and repurchase agreement financing trades executed on Thursday, the notice said. ICBC FS operates independently from ICBC in China, he added, and neither the headquarters nor the New York branch of ICBC itself were affected.

A Treasury Department spokesperson said, “We are aware of the cybersecurity issue and are in regular contact with key financial sector participants as well as federal regulators. We continue to monitor the situation.”

“This is a big party in [Fixed Income Clearing Corporation]then [é] certainly of great concern and potentially impacting U.S. Treasury liquidity,” said an executive at a large bank that clears U.S. Treasuries. The Fixed Income Clearing Corporation handles the settlement and clearing of U.S. Treasury trades.

US Treasury yields rose sharply on Thursday following a particularly bad auction for 30-year bonds. The 30-year yield rose 0.12 percentage points to 4.78%. It was unclear whether the auction was affected by the attack on ICBC FS.

The bank said it reported the incident to law enforcement authorities. Ransomware attacks have proliferated since the coronavirus pandemic, in part because remote work has left companies more vulnerable and because cybercriminal groups have become more organized.

However, it was “extremely unusual for a bank the size of [ICBC FS] be impacted like this,” said Allan Liska, threat intelligence analyst at cybersecurity firm Recorded Future, noting that the financial sector invests more in protecting against cyberattacks than any other.

The attack was carried out using LockBit 3.0 software, according to two sources. The software was developed by LockBit, which has become one of the most well-known cybercriminal groups in recent years.

The group, believed to operate in Russia and Eastern Europe, also rents its software to affiliates, a model known as RaaS, or ransomware-as-a-service. It was unclear whether Thursday’s raid was carried out by the criminal group or one of its clients.

The law firm Allen & Overy was also the target of a ransomware attack on its servers this Thursday. The company said it was investigating the impact of the attack and informing affected customers.