U.S. arm of China mega-lender ICBC hit by ransomware attack

The U.S. arm of China's largest bank said Thursday that it was hit by a ransomware attack, forcing clients to reroute trades and disrupting the U.S. Treasury market.

Ransomware attacks typically access vulnerable computer systems and encrypt or steal data, before sending a ransom note demanding payment in exchange for decrypting the data or not releasing it publicly.

The Industrial and Commercial Bank of China Financial Services (ICBC FS) said Thursday it "experienced a ransomware attack that resulted in disruption to certain (financial services) systems."

"Immediately upon discovering the incident, ICBC FS disconnected and isolated impacted systems to contain the incident," the New York-based bank said, adding that it was investigating the attack and working on recovery.

ICBC FS said it had successfully cleared U.S. Treasury trades executed Wednesday and repurchasing (repo) financing trades Thursday.

Bloomberg reported that some trades handled by ICBC FS on Thursday were transported across Manhattan on a USB stick as messengers manually relayed required settlement details.

China's foreign ministry said Friday that "the business systems and office systems of the head office of ICBC and other domestic and foreign branches and subsidiaries within the group are normal."

"As far as we know, ICBC has paid close attention to this matter, and has done a good job in emergency handling and supervision and communication, striving to minimize the impact of risks and losses," foreign ministry spokesman Wang Wenbin said at a regular news briefing. "At present, the business systems and office systems of the head office of ICBC and other domestic and foreign branches and subsidiaries within the group are normal."

U.S. media reported that the hack was executed using software created by Lockbit, the Russian-speaking hacking group known for scrambling files on a host's computer and flashing up messages demanding cryptocurrency payment to resolve the issue.

U.S. aircraft manufacturer Boeing was hit with an attack from Lockbit last week.Last year, LockBit was "the most deployed ransomware variant across the world and continues to be prolific in 2023," according to the U.S. Cybersecurity and Infrastructure Security Agency.

The U.S. Justice Department said in May that LockBit ransomware had been used in more than 1,400 attacks globally. LockBit has targeted critical infrastructure and large industrial groups, with ransom demands ranging from EUR5 million to EUR70 million.

The group attacked Britain's Royal Mail in early January and a Canadian children's hospital in December.