China says the Industrial and Commercial Bank of China (ICBC) is trying to limit the impact of a US ransomware attack

Open Editor’s Digest for free

Rula Khalaf, editor of the Financial Times, picks her favorite stories in this weekly newsletter.

China’s Foreign Ministry said the Industrial and Commercial Bank of China is trying to minimize losses after a ransomware attack on the country’s largest bank disrupted the US Treasury bond market.

At a press conference on Friday, the ministry said the Industrial and Commercial Bank of China had done a good job in handling the attack on its financial services arm.

Ministry spokesman Wang Wenbin said: “The Industrial and Commercial Bank of China has been closely monitoring the matter and has made every effort in emergency response and supervisory communications.”

New York-based financial services bank ICBC has in recent years become a major player on Wall Street in terms of treasury clearing as Chinese lenders expand abroad.

The Industrial and Commercial Bank of China said in a post on an official social media account in China this year that it is the only Chinese broker with a securities clearing license in the United States. She set up the company after purchasing the principal dealer services unit of Fortis Securities in 2010.

A notice on the ICBC FS website on Thursday evening confirmed the Financial Times story that it had “suffered a ransomware attack that took some services down.” [financial services] Systems.” The attack began on Wednesday.

The bank was “conducting a comprehensive investigation and… added that it is making progress in recovery efforts” with the help of information security experts, adding that neither the head office nor the branch of the Industrial and Commercial Bank of China itself in New York was affected.

The attack prevented ICBC FS from settling treasury transactions on behalf of other market participants, according to traders and banks. Hedge funds and asset managers redirected trades due to the disruption and the attack had some impact on Treasury market liquidity, according to trading sources.

The cyberattack has “limited impact and has been almost resolved,” according to a Chinese regulatory source. The attack “will not trigger further regulatory review at this point into the weakness of Chinese financial institutions’ offshore systems in general,” this person said, adding that the case has been reported to China’s National Administration for Financial Regulation (NAFR), which oversees the country’s commercial banks. .

After news of the ransomware attack emerged, employees at ICBC Bank’s Beijing headquarters held urgent meetings with their US unit, according to one employee who participated in these meetings.

NAFR, China’s central bank and the Industrial and Commercial Bank of China did not immediately respond to emailed requests for comment. Industrial and Commercial Bank of China (ICBC) shares fell 0.5 percent in Hong Kong on Friday, while Shanghai-listed stocks traded flat on mainland markets.

Ransomware attacks have proliferated since the coronavirus pandemic, partly because remote work has made companies more vulnerable and because cybercriminal groups have become more organized.

“The ICBC incident is a reminder of the high risks involved and the essential role of putting people and measurable behavior change at the center of protecting an organization’s digital assets,” said Oz Alashi, founder of CybSafe, a British cybersecurity and data analysis company.

“As cyber attacks become more dangerous, complex and frequent, often involving human error, companies urgently need to rethink their approach to ransomware defense,” he said.

ICBC FS had assets totaling $24.5 billion at the end of June 2023, and posted a loss of $11.8 million during the first six months of 2023, according to the parent group’s half-year report. Meanwhile, the Industrial and Commercial Bank of China’s total assets reached RMB43.7 trillion ($5.9 trillion) at the end of June.