Three seats at ICBC’s ransomware attack, and the plan each one needed

The week

On November 8, 2023, ICBC Financial Services, the U.S. broker-dealer subsidiary of the Industrial and Commercial Bank of China, was hit by ransomware that disrupted some of its systems. In a statement the next day, the firm said it had disconnected and isolated affected systems and had cleared U.S. Treasury trades executed on November 8 and repo financing trades done on November 9. Reporting at the time described the firm temporarily owing a large sum to its settlement bank, and some market participants rerouting or delaying trades, with the industry association SIFMA keeping members informed. The LockBit ransomware group was widely reported to be responsible. The Treasury Department said it was in contact with key financial sector participants and regulators and was not aware of broader impact.

ICBC Financial Services was a meaningful participant in Treasury and repo markets but not a dominant one. A firm of that size, hit by a common ransomware group, still briefly disturbed settlement in the world’s most important bond market. An earlier article in this series looked at the ION attack of early 2023, where the weak point was a shared post-trade vendor. Here the weak point was a market participant, and the incident looked different depending on where a firm sat. There are three seats, and between them they cover everyone involved: the firm that was hit, the counterparties deciding whether to keep trading with it, and the settlement bank carrying its obligations. Any broker-dealer or bank can occupy each of them, so each needs its own plan.

The firm that was hit

Full recovery from ransomware takes weeks. Settlement obligations fall due the same day or the next. The victim’s problem is therefore narrower than recovery: what is the minimum capability needed to confirm and settle outstanding positions, and how fast can it run from infrastructure the attacker never touched? Reports that the firm resorted to manual and improvised means to pass transaction details show what happens when that question has no prepared answer.

A minimum viable settlement capability has three ingredients. The first is data: a record of open positions and obligations that can be rebuilt from sources outside the compromised network, such as clearing statements, settlement bank reports and counterparty confirmations. The second is a clean environment: a small set of devices, accounts and connections kept separate from the main domain, enough to run confirmations and instruct the settlement bank. The third is people: named staff who know the manual procedures and are authorized to use them. FINRA already requires member firms to maintain business continuity plans. A scenario in which the primary environment is unusable, rather than merely unreachable, deserves explicit treatment within them, and an annual test with the clearing and settlement providers.

The counterparties deciding whether to keep trading

When a firm is known to be compromised, its counterparties choose between keeping connections open and risking contamination, or cutting them and losing the ability to transact. Reports from November 2023 described firms disconnecting from ICBC Financial Services as a precaution. That is a sensible instinct, and it adds to the disruption, because each cut connection is a trade that must be settled another way.

Two decisions need prior authority. Disconnection should be pre-approved by connection type: file transfers and email links can be suspended by the security team at once, while settlement messaging may need sign-off from operations leadership because obligations continue. Reconnection is harder, because nobody wants to be the first to let a recovering firm back in. A counterparty should know in advance what evidence it will accept. Typical items are a third-party forensic firm’s statement that the attacker has been removed, confirmation that credentials and keys used on shared connections have been rotated, and a description of the rebuilt environment. SIFMA had published a reconnection framework for this purpose in 2020 and issued an updated edition in November 2023. The framework helps only if a firm has mapped it to its own connection inventory, with an owner for each link who can apply the evidence test and record the decision. Without that map, reconnection decisions default to whoever is most anxious, and the recovering firm faces a dozen different sets of questions instead of one.

The settlement bank carrying the obligations

Treasury settlement runs through a small number of clearing banks and, for part of the market, central clearing. When a participant cannot deliver cash or securities on time, its settlement bank may extend intraday credit to bridge the gap. That exposure can grow very quickly in a market that settles enormous volumes daily. In this case the gap was reportedly closed after the parent provided capital. A settlement bank cannot count on a well-capitalized parent every time.

The settlement bank’s plan has three parts. Credit limits and collateral terms for clients should anticipate operational failure as well as credit deterioration, with a clear point at which the bank stops extending credit to a client that cannot process. Operations staff need a procedure for receiving instructions from a client whose systems are down, including how to authenticate a request arriving by unusual means, which is exactly when fraud attempts follow. And the bank needs a communication path with supervisors and the wider market that does not depend on the troubled client.

Every large firm should run one tabletop exercise that moves through all three seats. Assign one team the victim’s role, another the counterparties, and a third the settlement bank, and play the first trading day. The friction points, such as which evidence the counterparties demand and whether the victim can produce it, show up within the first hour.

With hindsight

The disruption was short, and the market absorbed it. In December 2023 the SEC adopted rules requiring more Treasury cash and repo transactions to be centrally cleared, with compliance dates later extended to the end of 2026 and mid-2027. Central clearing addresses counterparty credit risk more than operational risk, and it moves settlement concentration toward the clearing house rather than removing it. In February 2024 an international law enforcement operation disrupted LockBit’s infrastructure, though the group and its affiliates did not disappear. SIFMA and the Financial Services Sector Coordinating Council published a further update to the reconnection framework in December 2025, a sign that the counterparty seat remained the least settled of the three. A later article in this series examines the same reconnection problem when ransomware struck a healthcare clearinghouse in 2024.