INDUSTRIAL and Commercial Bank of China (ICBC) injected capital into its US unit to pay BNY Mellon US$9 billion for unsettled trades and hired a cybersecurity firm to help it return online after a ransomware attack, sources familiar with the matter said.

ICBC said on Thursday (Nov 9) it had been hit by a ransomware attack, the latest in a string of ransom demands by hackers this year. ICBC Financial Services, the bank’s US unit, said it was investigating the attack that disrupted some of its systems, and making progress towards recovering from it.

The cyberattack sent ripples through the US Treasuries market, where ICBC acts as a broker for hedge funds and other market participants, helping them trade in the securities.

When the hack happened earlier this week, ICBC was unable to access its systems, leaving it temporarily owing BNY US$9 billion for unsettled trades, two of the sources said. The custody bank is the sole settlement agent for US Treasuries.

The Chinese parent then injected capital into the US unit, allowing it to settle the trades and pay back BNY Mellon, the sources said. That has now happened, they said.

ICBC did not respond to a request for comment.

GET BT IN YOUR INBOX DAILY

Start and end each day with the latest news stories and analyses delivered straight to your inbox.

Sign UpVIEW ALL

ICBC’s representatives told market participants on a call organised by the Securities Industry and Financial Markets Association (Sifma), a trade group, on Friday afternoon that they had hired a cybersecurity firm to do an assessment to ensure that its systems are safe, three sources familiar with the matter said.

ICBC said it hopes to be done as soon as this weekend, the sources said, noting that it could take longer, given the complexity of the task.

Meanwhile, ICBC’s computer systems have been isolated from the rest of Wall Street, the sources said. But alternative systems have been put in place to enable trading by ICBC, which involve moving information manually, including by carrying USB sticks with information, two of the sources said.

Sifma declined to comment.

“These cyberattacks are scary,” said Jack McIntyre, a fixed-income portfolio manager at Brandywine. “The good news would be that I guarantee you primary dealers are having (a) discussion to make sure this cannot happen to them. I’m sure everybody’s doing a deep dive on their security systems.” REUTERS