ICBC US Subsidiary Hit by Ransomware... "Disruption in Bond Trading"

Impact of Previous Day's Weak US Treasury Auction
Ripples Extend to New York Stock Market

China's state-owned commercial bank, Industrial and Commercial Bank of China (ICBC), experienced disruptions in bond trading due to a ransomware attack on its U.S. subsidiary. Analysts suggest that this incident may have also contributed to weak demand in recent U.S. Treasury auctions.

On the 10th (local time), ICBC Financial Services, a subsidiary of ICBC, announced on its website that some of its computer systems were damaged by a ransomware attack on the 8th.

ICBC Financial Services is a wholly owned subsidiary of ICBC. Headquartered in New York, it handles securities trading orders and settlements for institutional investors from various countries.

ICBC Financial Services stated, "Upon discovering the incident, we immediately isolated the affected systems and are currently investigating with expert support to carry out recovery efforts." They added, "The operations and email systems of ICBC Financial Services are run independently from the ICBC Group, so the ICBC headquarters, other Chinese and overseas affiliates, and ICBC New York Branch were not affected by this incident."

They also explained that despite the cyberattack, they successfully completed U.S. Treasury trading orders on the 8th and repurchase agreement settlements on the 9th.

Bloomberg reported that due to the computer system outage, ICBC Financial Services had to carry payment information on USB portable storage devices while moving through the streets of Manhattan, New York, to prevent losses from payment defaults.

According to major foreign media, the cybercriminal group known as "LockBit," believed to be linked to Russia, has claimed responsibility for the ransomware attack. This group has previously launched cyberattacks against Boeing and British financial institutions.

Meanwhile, there is analysis that this cyberattack incident has had a considerable impact on the overall U.S. bond market. The weak demand observed in the U.S. Treasury auction on the 9th is likely related to this ransomware attack.

Earlier, the U.S. Treasury conducted a 30-year bond auction on the morning of the 9th, but demand was weaker than usual. The yield on U.S. Treasury issuance was set 0.051 percentage points higher than the rate before the auction, and the bid-to-cover ratio was the lowest since 2021. As a result, long-term Treasury yields surged on the same day, and the New York stock market turned bearish.

The British daily Financial Times (FT), citing anonymous sources, reported that after the ransomware attack became known, hedge funds and asset management firms adjusted their trades, causing turmoil across the bond market and affecting trading liquidity to some extent.

Tom De Galloma, Managing Director at BTIG, told MarketWatch, "While the extent is unclear, the cyberattack may have had a dramatic impact on the Treasury auction. When people know there could be problems with settlements, they hesitate to trade, and that is exactly what happened on the 9th."