Ion Group, a Dublin-based software company that helps financial institutions automate their critical business processes, has been hit by a ransomware attack that forced several European and U.S. banks to revert to manual processes.
The cyberattack, which TechCrunch learned about on Tuesday, affected Ion’s Cleared Derivatives division, which provides software for automating the trading lifecycle and the derivatives clearing process. Unlike physical assets, derivatives are financial products that derive value from a relationship to another underlying asset. Common types of derivatives include currencies, stocks, bonds and commodities.
Ion said in a short statement that it “experienced a cybersecurity event” on Tuesday that affected some of its services. “The incident is contained to a specific environment, all the affected servers are disconnected, and remediation of services is ongoing.”
Ion spokesperson Suezelle D’Costa declined to share further details, such as the nature of the incident or how the organization was compromised. However, a memo from Ion obtained by Bloomberg confirms the attack was the work of the Russian-linked LockBit ransomware gang, which last month hit U.K. postal giant Royal Mail, forcing the mail service to suspend international deliveries.
LockBit claimed responsibility for the attack and is threatening to leak data stolen from the company on February 4 unless a ransom demand is paid, according to the ransomware gang’s dark web site and seen by TechCrunch. It’s not yet known how much and what types of data were stolen. Ion spokesperson D’Costa declined to comment.
The impact of the incident also remains unclear, but Bloomberg reports that the attack affected at least 42 of Ion’s clients and forced several European and U.S. financial institutions to process some derivative trades manually. A person with knowledge of the incident told TechCrunch that many commercial banks worldwide are experiencing issues, such as the ability to get quotes, following the ransomware attack.
The Futures Industry Association, a U.S.-based industry advocacy group for the futures, options and cleared derivatives markets, said in a statement that the incident is “impacting the trading and clearing of exchange-traded derivatives by Ion customers across global markets.”
The FIA added that it is working with impacted members to assess the extent of the impact.
Meanwhile, the U.S. Treasury said it’s monitoring the situation and downplayed the risk to U.S. financial markets.
In a statement provided to TechCrunch, Treasury senior cybersecurity official Todd Conklin said the Treasury is aware of the ransomware attack but said that the incident is isolated to a small number of smaller and mid-size firms.
“The issue does not pose a systemic risk to the financial sector,” said Conklin. “We remain connected with key financial sector partners, and will advise of any changes to this assessment.”
Ion told clients on Thursday that its systems won’t be fully operational until February 6, according to email correspondence seen by Bloomberg.
https://techcrunch.com/
Cybercriminals are actively exploiting a two-year-old VMware vulnerability as part of a ransomware campaign targeting thousands of organizations worldwide. Reports emerged over the weekend that VMware ESXi servers left vulnerable and unpatched against a remotely exploitable bug from 2021 were compromised and scrambled by a ransomware variant dubbed “ESXiArgs.” ESXi is VMware’s hypervisor, a technology that […]
The Housing Authority of the City of Los Angeles, or HACLA, has confirmed it is investigating a cybersecurity incident shortly after the LockBit ransomware gang claimed responsibility for a cyberattack on the agency. HACLA, which provides affordable housing to more than 19,000 low-income families across Los Angeles, was added to LockBit’s dark web leak site on […]
Royal Mail CEO Simon Thompson has confirmed that a cyberattack is to blame for the ongoing disruption at the U.K. postal giant. The admission comes almost a week after Royal Mail first said it was hit by an unspecified “cyber incident” that left the British mail service unable to dispatch items to overseas destinations. “We’ve confirmed that we’ve had a […]
Leave a Reply