Financial software firm ION Group was the victim of a ransomware attack on January 31. The attack affected ION’s Cleared Derivatives division. In a press release, ION wrote, “The incident is contained to a specific environment, all the affected servers are disconnected.”
Note
- Not a lot of information out on this one – the important part is always *why* and *how* the attack succeeded. In the financial world, being forced to use slower manual trading/reconciliation processes can carry huge costs to customers and the financial organization hit swamps recovery costs.
- The LockBit ransomware group is taking credit for this attack, threatening to leak data on Feb 4 unless the ransom demand is paid. Financial institutions using their services currently have to process trading and clearing of exchange-traded derivatives manually. The question is how long manual processing will be viable. When reviewing DR plans, this is something to contemplate and at least plan for a point where you need to move to a new automated system before the business impact is unacceptable.
- This ransomware attack, while specific to financial trading systems, is a good reminder for every enterprise to revisit their SLA with third party software vendors. Reliance on third party vendors for products and services should be part of a company’s risk assessment; and mitigations such as switching to staff intensive processes regularly tested to counter impacts to business operations.
Read more in
