Summary
- Environment: Financial services
- Operational impact: Disrupted US Treasury market clearing/settlement; trades settled via USB courier as a workaround
- Financial impact: No financial figure is established by the reviewed source evidence
- Record status: Developing record. Reviewed September 19, 2026; updated as evidence emerges.
What happened
In Nov 2023, Industrial and Commercial Bank of China Financial Services experienced an incident in its financial services environment. The retained source describes the attack path as follows: LockBit ransomware. [1]
The documented consequence was: Disrupted US Treasury market clearing/settlement; trades settled via USB courier as a workaround. [1]
Impact
- Documented impact: Disrupted US Treasury market clearing/settlement; trades settled via USB courier as a workaround. [1]
- No financial loss, ransom amount, recovery cost, or regulatory penalty is established by the reviewed source evidence.
Threat Group & Attack Vector
The retained source describes the attack path as follows: LockBit ransomware. The canonical record does not add intrusion steps beyond those supported by the source. [1]
Actors
- LockBit — identified in the supported attack description. [1]
TTPs
- T1486 — Data Encrypted for Impact — mapped from the cited behavior. [1]
Response
The reviewed source does not describe containment, notification, or restoration steps in enough detail to summarize them responsibly.
This account is bounded to United States sanctions affiliates of LockBit ransomware group. Details absent from that evidence are left unresolved rather than inferred. [1]