China's Biggest Lender ICBC Confirms Ransomware Attack, Disrupts Trades In US Treasury market

The U.S. financial services division of the Industrial and Commercial Bank of China (ICBC) faced a cyberattack, impacting Treasury trades and prompting an investigation, and ICBC isolated affected systems to contain the disruption.

The Industrial and Commercial Bank of China is the world's largest lender by assets.

ICBC cleared U.S. Treasury trades executed on Wednesday and repo financing trades on Thursday, reassuring stakeholders. 

However, conflicting reports suggested disruption in Treasury trades, with the Financial Times stating that the attack prevented ICBC from settling trades for other market participants.

The cybersecurity firm Truesec identified the ransomware as LockBit 3.0, a challenge for security researchers due to its evasive nature, CNBC noted. 

LockBit, responsible for 28% of known ransomware attacks, operates as a "ransomware-as-a-service" business model, selling its malicious software to affiliates. The group, led by "LockBitSup," claims a non-political motivation on its dark web forums.

ICBC said the email and business systems of its U.S. financial services arm operate independently of ICBC's China operations. The systems of its head office, the ICBC New York branch, and other domestic and overseas affiliated institutions were not affected by the cyberattack, CNBC noted.

"In general, the event had a limited impact on the market," Reuters noted, citing Scott Skyrm, executive vice president for fixed income and repo at broker-dealer Curvature Securities.

Disclaimer: This content was partially produced with the help of AI tools and was reviewed and published by Benzinga editors.