Skip to content

Which companies just had a verified incident, who lends to them and who owns them. Every claim carries its evidence level and its source. How we decide what is confirmed

Global Financial Service Disruptions

ICBC Financial Services

clearing settlement · US · North America · Industrial and Commercial Bank of China Financial Services LLC

Confirmed cyberStatus: resolvedTier 1Severity 5 of 5Evidence confidence: highAnalyst-verified

The US broker-dealer arm of ICBC was hit by ransomware on 8 November 2023 and could not settle US Treasury trades for clients, forcing market participants to reroute. ICBC confirmed the attack and said it had cleared some trades by 9 November.

First disruption
Nov 8
First public signal
unknown
Acknowledged
Nov 9
Restored
resolved, time unknown
Duration
not established
DFX first recorded
Nov 5 14:58 UTC

What was restricted

merchant settlementtradingScope: multi institution

ICBC FS could not settle US Treasury trades for other market participants; clients rerouted trades; reports of settlement via USB drives carried by messenger (single source).

Financial impact: Ransom reportedly paid per gang claim (unverified, amount undisclosed)

Cause, kept in separate layers

What the institution said
Ransomware attack 'resulting in disruption to certain systems'; LockBit linked
DFX classification
Confirmed cyber (cyber: confirmed)
Wording used
disruption to certain systems
Conflicting reports
ICBC said trades were cleared while others reported continued disruption.

Dependencies

A dependency is a documented relationship. It is not evidence that the provider was compromised.

  • Provider: Citrix NetScaler (perimeter appliance (unpatched CVE-2023-4966)), probable
  • Downstream: US Treasury and repo market participants: Trades failed to settle or were rerouted (documented)

Evidence