ICBC Paid Ransom, Says Hacking Gang Lockbit

China's Industrial and Commercial Bank (ICBC) reportedly paid a ransom to the Lockbit ransomware gang following a cyberattack last week. A representative from the group claimed that ICBC settled the ransom in a statement to Reuters.

ICBC's US branch fell victim to a ransomware attack on 9 November, resulting in disruptions to trades in the US Treasury market. The severity of the breach was such that ICBC's blackout temporarily left them owing an astounding USD 9 billion to BNY Mellon, a sum several times larger than its net capital.

Reuters report suggests that the cyber intrusion extended far beyond financial disruptions. Corporate email systems at ICBC ceased to function, prompting employees to shift communications to Google mail.

The cyberattack on ICBC's US operations has raised concerns about the resilience of the USD 26 trillion Treasury market, a linchpin of global finance. The incident is likely to draw scrutiny from regulators.

Lockbit, the ransomware gang claiming responsibility, has gained notoriety in recent years. According to US officials, it has quickly become the world's top ransomware threat. The group's modus operandi involves hacking large organisations globally and stealing or leaking sensitive data when victims refuse to pay the ransom.

Authorities have consistently advised against paying ransoms to cybercriminals, emphasising the importance of breaking the criminal business model. However, the prevalence of such attacks, often demanding payment in cryptocurrencies for anonymity, has led some entities to opt for payments to expedite system restoration and mitigate reputational damage.

Lockbit's reach extends beyond financial institutions, as evidenced by recent disclosures. Last week, the hackers claimed to have infiltrated aerospace giant Boeing and infected computer systems at the law firm Allen & Overy, underlining the widespread impact of their activities.