Ransomware attack on data firm ION could take days to fix -sources

FILE PHOTO: A man types on a computer keyboard in front of the displayed cyber code in this illustration picture taken on March 1, 2017.REUTERS/Kacper Pempel/Illustration/File Photo

LONDON/MILAN (Reuters) -A ransomware attack that hit ION Trading UK could take days to fix, leaving scores of brokers unable to process derivatives trades, sources familiar with the matter told Reuters on Thursday.

ION Group, the financial data firm's parent company, said in a statement on its website that the attack began on Tuesday.

"The incident is contained to a specific environment, all the affected servers are disconnected, and remediation of services is ongoing," ION Group said, declining requests for further comment.

Ransomware is a form of malicious software deployed by criminal gangs which works by encrypting data, with hackers offering the victim a key in return for payments. Such ransom demands can total millions of dollars.

Officials on both sides of the Atlantic are monitoring the disruption.

"We're aware of this ongoing incident and we will continue to work with our counterparts and the firms affected," Britain's Financial Conduct Authority (FCA) and the Prudential Regulation Authority (PRA) said on Thursday.

The Federal Bureau of Investigation told Reuters it was also aware of the hack, although it declined further comment. Bloomberg News reported that the FBI had been in touch with Ion executives about the incident.

Among the many ION clients whose operations were likely to have been affected were ABN Amro Clearing and Intesa Sanpaolo, Italy's biggest bank, messages to clients from both banks which were seen by Reuters showed.

The Futures Industry Association (FIA) said issues at ION had affected the trading and clearing of exchange-traded financial derivatives, although there had been no reports of margin problems in financial markets.

ABN told clients on Wednesday that due to "technical disruption" from ION, some applications were unavailable and were expected to remain so for a "number of days".

It added that its staff had to process trades directly with the exchange.

In response to questions from Reuters, ABN said it is not currently seeing any "relevant disruptions".

"ABN AMRO Clearing has taken appropriate action to keep its operations safe, including informing its clients beforehand on what might happen," it said in an e-mailed statement.

Intesa Sanpaolo told clients that its brokerage and clearing operations on exchange-traded derivatives had been "severely hampered" by IT problems at ION and that it was not able to handle orders.

The bank told Reuters it was waiting for ION to indicate when it could can restart "normal and safe" operations, adding that the ransomware attack targeting the trading services company had not impacted its own systems.

A source with knowledge of the matter said the attack put brokers that process complex over-the-counter trades involving products such as options in a difficult situation and the problem could take another five days to fix.

Lockbit said it would publish stolen data on Feb. 4 if ION Group failed to pay a ransom, a screenshot of the group's blog on the dark web on darkfeed.io, a website which tracks ransomware groups, showed.

Lockbit ransomware has been detected all over the world, with organisations in the United States, India and Brazil among the common targets, cybersecurity firm Trend Micro said.

Trend Micro has called the group, which some cybersecurity experts say has members in Russia, "one of the most professional organised criminal gangs in the criminal underground".

Britain's National Cyber Security Agency (NCSC), part of Britain's GCHQ eavesdropping intelligence agency, said it had no immediate comment when contacted by Reuters.

(Reporting by James Pearson in London and Danilo Masoni in Milan; Additional reporting by Harry Robertson and Amanda Cooper in London, Valentina Za in Milan and Raphael Satter in Washington; Editing by Alexander Smith, Kirsten Donovan and Marguerita Choy)

Article type: free
User access status:
Subscribe now to our Premium Plan for an ad-free and unlimited reading experience!


Next In Tech News

Poland's CD Projekt posts 66% profit leap
Ford withdraws petition seeking U.S. approval to deploy self-driving vehicles
US semiconductor index hits highest in nearly a year on hopes for industry turn
Apple wins U.S. appeal over patents in $502 million VirnetX verdict
Block says Cash App has 44 million verified monthly users after Hindenburg report
Meta rolls out long-sought tools to separate ads from harmful content
U.S. advocacy group asks FTC to stop new OpenAI GPT releases
US woman scammed out of over US$1,800 in puppy scam
Streaming device maker Roku to cut 200 jobs in second round of layoffs
‘This job is very easy to earn’: Loan sharks in SG take to Telegram to recruit runners

Others Also Read