On Thursday, trades handled by the world's largest bank in the globe's biggest market traversed Manhattan on a USB stick.
Industrial & Commercial Bank of China Ltd.'s U.S. unit had been hit by a cyberattack, rendering it unable to clear swathes of U.S. Treasury trades after entities responsible for settling the transactions swiftly disconnected from the stricken systems. That forced ICBC to send the required settlement details to those parties by a messenger carrying a thumb drive as the state-owned lender raced to limit the damage.
The workaround — described by market participants — followed the attack by suspected perpetrator Lockbit, a prolific criminal gang with ties to Russia that has also been linked to hits on Boeing Co., ION Trading UK and the UK's Royal Mail. The strike caused immediate disruption as market-makers, brokerages and banks were forced to reroute trades, with many uncertain when access would resume.
The incident spotlights a danger that bank leaders concede keeps them up at night — the prospect of a cyberattack that could someday cripple a key piece of the financial system's wiring, setting off a cascade of disruptions. Even brief episodes prompt bank leaders and their government overseers to call for more vigilance.
"This is a true shock to large banks around the world," said Marcus Murray, the founder of Swedish cybersecurity firm Truesec. "The ICBC hack will make large banks around the globe race to improve their defenses, starting today."
As details of the attack emerged, employees at the bank's Beijing headquarters held urgent meetings with the lender's US division and notified regulators as they discussed next steps and assessed the impact, according to a person familiar with the matter. ICBC is considering seeking help from China's Ministry of State Security in light of the risks of potential attack on other units, the person said.
Late Thursday, the bank confirmed it had experienced a ransomware attack a day earlier that disrupted some systems at its ICBC Financial Services unit. The company said it isolated the affected systems and that those at the bank's head office and other overseas units weren't impacted, nor was ICBC's New York branch.
ICBC is closely following the cyberattack and will take "effective" emergency response measures, Wang Wenbin, a spokesman for the Chinese Foreign Ministry, said at a regular briefing Friday in Beijing. The bank will engage in proper supervision and communication to minimize the risks, impact and losses, Wang said.
The extent of the disruption wasn't immediately clear, though Treasury market participants reported liquidity was affected. The Securities Industry and Financial Markets Association, or Sifma, held calls with members about the matter Thursday.
ICBC FS offers fixed-income clearing, Treasuries repo lending and some equities securities lending. The unit had $23.5 billion of assets at the end of 2022, according to its most recent annual filing with US regulators.
The attack is only the latest to snarl parts of the global financial system. Eight months ago, ION Trading UK — a little-known company that serves derivatives traders worldwide — was hit by a ransomware attack that paralyzed markets and forced trading shops that clear hundreds of billions of dollars of transactions a day to process deals manually. That has put financial institutions on high alert.
ICBC, the world's largest lender by assets, has said it's been improving its cybersecurity in recent months, highlighting increased challenges from potential attacks amid the expansion of online transactions, adoption of new technologies and open banking.
