INCIDENT REPORT · CP-2023-005
ICBC Financial Services ransomware attack
L3 · ELEVATEDCONFIRMED
The US broker-dealer arm of the Industrial and Commercial Bank of China confirmed a ransomware attack that disrupted some of its systems. Sources date the start to 8 or 9 November 2023.
- Incident ID
- CP-2023-005
- Incident date
- 08 NOV 2023
- Detection date
- Not publicly documented
- Affected countries
- United States
- Plotted location
- New York, United States (Affected organization headquarters (ICBCFS))
- Threat classification
- Level 3 — ELEVATED
- Classification rationale
- Ransomware at a subsidiary of the world's largest bank briefly disrupted US Treasury market settlement.
- Attack type
- Ransomware
- Nature
- Malicious activity
- Attack vector
- Not publicly documented
- Sectors
- Finance
- Critical infrastructure
- Yes
- Organizations affected
- Industrial and Commercial Bank of China Financial Services (ICBCFS)
- Operational consequences
- The unit could not settle US Treasury trades for market participants, and some trades had to be rerouted. LockBit told Reuters it carried out the attack.
- Estimated financial impact
- No reliably documented figure
- Attribution (as stated)
- No official attribution recorded
SOURCE REFERENCES
- [1] Hackers disrupt one of world's biggest bank's trades with U.S. TreasuryCBC News (Reuters) · cbc.ca
- [2] Ransomware attack on Chinese bank interrupts U.S. Treasury tradingAmerican Banker · americanbanker.com
RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.