NEW YORK/LONDON, Nov 10 (Reuters) – The Industrial and Commercial Bank of China injected capital into its U.S. unit to help BNY Mellon (BK.N) pay $9 billion for uncertain transactions and hired a cybersecurity firm to help normal operations could resume after a ransomware attack, sources familiar with the matter say.
ICBC’s U.S. unit told market participants on Friday that it hoped to complete the cyber review this weekend, but the sources said they expected that to happen next week. Meanwhile, the bank is using manual processes to trade, they said.
The details, including the cash injection for uncertain transactions, have not been previously reported.
The ransomware attack was claimed by cybercrime gang Lockbit, a widespread ransomware first spotted on cybercrime forums in Russian in January 2020. It is the latest in a series of ransom demands from hackers this year.
The cyberattack sent ripples through the U.S. Treasury market, where ICBC acts as a broker for hedge funds and other market participants, helping them trade the securities. While the scale of the market disruption was limited, it highlighted the resilience of a market that underpins the global financial sector.
When the hack occurred earlier this week, ICBC was unable to access its systems, temporarily owing BNY$9 billion for insecure transactions, two sources said. The custodian bank is the sole settlement agent for government bonds.
The Chinese parent then injected capital into the US unit, allowing it to settle the transactions and repay BNY Mellon, the sources said. That has now happened, they said.
ICBC did not respond to a request for comment. ICBC Financial Services, the bank’s U.S. unit, said it is investigating the attack that disrupted some of its systems and is making progress toward recovery.
ICBC representatives told market participants on a call hosted by the Securities Industry and Financial Markets Association (SIFMA), a trade group, Friday afternoon that they had hired a cybersecurity firm to conduct an assessment to ensure its systems are secure, three sources familiar with the matter said.
ICBC said it hopes to be ready this weekend, the sources said, noting it could take longer given the complexity of the task. They also told market participants about the capital injection, but did not disclose the amount or reason for it, the sources said.
Meanwhile, ICBC’s computer systems are isolated from the rest of Wall Street, the sources said. But alternative systems have been set up to enable trading by ICBC, which requires information to be moved manually, including by carrying USB sticks of information, two sources said.
SIFMA declined to comment.
Global regulators were monitoring the impact on Friday. U.S. Treasury Secretary Janet Yellen said Friday that she and Chinese Vice Premier He Lifeng discussed the issue during talks in San Francisco this week. She said the hack had not disrupted the US Treasury market.
Rumors of the hack began circulating in the market on Wednesday afternoon, but one of the sources close to a major market maker said it was not clear to most people on Wall Street what was going on until Thursday morning.
As news of the hack spread, other companies began removing any connection between ICBC’s computer systems and their own, the source said. SIFMA, the trade group, organized calls for market participants with updates, the sources said.
ICBC is not among the top firms trading government bonds, including primary dealers that trade directly with the New York Federal Reserve, limiting its impact on the market, the sources said.
Still, Scott Skyrm, who works at money market trading company Curvature Securities, said overnight rates in the repo market were volatile and closed Thursday at a lower level than they would otherwise have been. There was an increase in the number of companies that failed to repay the bonds they borrowed.
As the U.S. Treasury Department fails, the value of Treasury bonds not delivered to meet a trade contract rose to $62.2 billion on Thursday, the highest since March, up from $25.5 billion a day earlier, according to Depository Trust & Clearing Corp.
To give the market more time to settle trades, the Federal Reserve’s system for moving cash through the financial system said it had extended the cut-off time for certain customers on Friday.
“These cyber attacks are scary,” said Jack McIntyre, fixed income portfolio manager at Brandywine. “The good news would be that I guarantee the primary dealers are having (a) discussion to make sure this can’t happen to them. I’m sure everyone is doing a deep dive into their security systems.”
ICBC’s Hong Kong-listed shares ended Friday down 0.8%, compared with a 1.13% decline in a Hong Kong index of mainland Chinese banks. (.HSMBI) Shanghai-listed shares closed flat (601398.SS).