A ransomware attack on the Industrial and Commercial Bank of China (ICBC) disrupted trades in the US Treasury market.
ICBC Financial Services said it is recovering from a cyber attack that disrupted its systems and forced employees to trade with USB sticks. ICBC FS is the US unit of China’s biggest bank and the world’s largest commercial lender by total assets.
The attack rendered the bank unable to clear many US Treasury trades and caused it to temporarily owe BNY Mellon $9bn (£7bn). It could only return the debt after a cash injection from its Chinese parent.
ICBC has said it is working with cyber-security firm MoxFive to set up secure systems that would allow it to resume normal business on Wall Street. However, the disruption caused by the hack has raised concerns about the resilience of the $26tn (£21tn) Treasury market.
“Immediately upon discovering the incident, ICBC FS disconnected and isolated impacted systems to contain the incident,” the bank said. It added that it is “progressing its recovery efforts with the support of its professional team of information security experts”.
ICBC now has successfully cleared Treasury trades executed on Wednesday and repurchase agreements (repo) financing trades done on Thursday.
However, the Financial Times said that the ransomware attack prevented the ICBC division from settling Treasury trades on behalf of other market participants on Friday, with other news outlets reporting similar disruptions.
The US Treasury Department has said it is aware of the cyber-security issue and is in regular contact with key financial sector participants, in addition to federal regulators. “We continue to monitor the situation,” it added.
The attack has been attributed to cyber-crime gang LockBit. The hackers are said to have been responsible for attacking 1,700 US organisations since its discovery in 2020, according to the US Cybersecurity and Infrastructure Security Agency. Last month it threatened Boeing with a leak of sensitive data.
ICBC stressed that its domestic and overseas affiliates were not affected by the attack. The Chinese bank also said it is working with law enforcement to investigate the matter.
