A subsidiary of the Dublin-based financial technology and trading firm ION Group, ION Cleared Derivatives, has been hit by a cyberattack that has disrupted transactions for dozens of clients in both Europe and the United States. The attack has impacted the market for exchange-traded derivatives and has been carried out by the Russia-linked LockBit ransomware group.
Impact on the Derivatives Market
Derivatives are financial instruments whose value is tied to an underlying asset or benchmark, such as the price of oil, portfolios of debt, or stocks. The four broad categories of derivatives are options, futures, swaps, and forwards, with massive sums traded every day. The cyberattack on ION Cleared Derivatives has affected at least 42 of the company’s clients, disrupting their processing of derivative trades.
Effects on Industry Groups
Several members of two large industry groups in the United States, the CME Group and Intercontinental Exchange, have also been impacted by the attack. The Futures Industry Associations (FIA), which represents the area of futures contracts, is investigating the effects on its members.
LockBit Group Claims Responsibility
The infamous LockBit group, responsible for recent attacks on various targets, has claimed responsibility for the attack and posted a breach notice on its extortion site. The group uses a ransomware-as-a-service (RaaS) model and has named the ION Group as a compromised business.
The attack has had widespread effects, impacting clients of ION Cleared Derivatives’ services, as well as markets in the United States and parts of Asia, highlighting the interconnectedness of today’s financial and technological infrastructure. ION Group is used by financial institutions all over the world, so the attack is likely to have a wide-ranging impact on those institutions.
However, a senior US Treasury official stated that the disruption to the ION Cleared Derivatives platform does not pose a “systemic risk to the financial sector.” The immediate impact on ION Cleared Derivatives’ clients is that post-trade processes such as trade matching and keeping track of risk and margin requirements, which are normally automated by the company’s services, have to be completed manually.