Cyberattack Sends Quadrillion Dollars Derivative’s Trading Markets Back To The 1980s #GotBitcoin

Updated: 2-2-2023: The derivatives market is, in a word, gigantic—often estimated at over $1 quadrillion on the high end. Cyberattack Sends Quadrillion Dollars Derivative’s Trading Markets Back To The 1980s #GotBitcoin

* Shops Clearing Trades Were Forced To Process Deals Manually
* Incident Highlights Importance Of A Little Known Software Firm

Ultimate Resource On Bitcoin’s Ability To Fuel Market In Crypto Derivatives

Derivatives shops, used to clearing hundreds of billions of dollars in trades every day, found themselves in a dramatically different era this week: the old days of manually processing deals.

See Time Stamp: 22:27 (The 2023 Banking Crisis Fuse Has Been Lit)

Early Tuesday morning in Europe, a little known but critically important software company that underpins the smooth functioning of stock, bond and commodities markets started to seize up. London-based ION Trading UK had succumbed to a cyberattack.

Suddenly, in offices across the globe, traders and brokers turned to spreadsheets to keep track of their deals, firms resorted to inputting individual trades on websites provided by exchanges, and employees explained to their families why they were going into work at night, according to people with a view of the scene.

It was like being back in the 1980s, before electronic trading took off, or in the 1990s, when the web was just starting to change the world.

But there was a key difference — the banks and brokers handling client trades on bourses including Intercontinental Exchange Inc., CME Group Inc. and Cboe Global Markets no longer have hordes of employees ensuring deals are confirmed, processed and settled.

“The cyberattack on ION reminds us all that despite best efforts by any organization to protect itself, these issues will occur, and market participants need to be continuously vigilant and prepared for such instances,” said Joseph Schifano, head of regulatory affairs at Eventus, a trade surveillance software firm.

For the derivatives market, it was a slap in the face. Not only did companies lack adequate staff to meet the crisis, but many of the workers were too young to know how to keep operations afloat.

It was also the second time in just one week that a major market had been humbled. A human error at the New York Stock Exchange set off violent price swings at the start of trading on Jan. 24.

Banks and other financial firms frequently label cyber risk as among those they fear most — as the interconnectedness of the financial system has the potential to amplify the ramifications from any attack.

Both incidents also underscored how vital the plumbing underpinning trading processes can be, and that however sophisticated they may be, vulnerabilities lurk.

Attack Confirmed

ION first noticed an issue was preventing access to some of its systems at 2:30 a.m. London time. It took the Dublin-based firm — founded by Italian tycoon Andrea Pignataro — more than five hours to confirm the attack by Russian ransomware gang LockBit, according to correspondence from ION seen by Bloomberg.

It wasn’t long before the 42 ION clients affected started reporting difficulties. The US clearing arm of Dutch lender ABN Amro Bank NV sent out a note to clients saying the attack would delay overnight processing, and that it was being forced to deal with transactions manually.

StoneX Financial said it was taking “alternative measures” to clear trades and prioritizing expiring contracts. Marex Group resorted to providing clients “indicative” values of transactions in their accounts.

On the London Metal Exchange — one of the last venues in the world where trading still takes place face to face — the return to manual processing was familiar for many veteran brokers, but it also provided an opportunity for younger staff to prove their technological prowess.

When ION’s systems went down, a team of coders at one London brokerage scrambled to build their own ad-hoc system to match off clients’ trades, and they had it up and running within hours, according to one person familiar with the matter.
Liquidity Threat

But while those types of creative efforts have helped to mitigate the fallout so far, the challenges are growing as the crisis rolls on. Informally, the London brokerage has warned the LME that it expects dealers to reduce activity because of friction in processing trades, reducing liquidity, the person said.

Fear of contagion prompted the Futures Industry Association to hold over half a dozen calls over multiple days to give members a chance to talk through the situation and share relevant information. More than 600 people dialed in to one of these calls. Some were clients of ION, directly impacted by the attack. Others discussed potential ripple effects.

A spokesman for ION declined to comment on whether it had taken part in the FIA calls.

By the end of the day on Tuesday, neither the FIA nor the Commodity Futures Trading Commission — the top US derivatives regulator — disclosed or could confirm how many firms had been affected and how much money was locked up in trades handled by ION, said people who took part in the calls and asked not to be identified, citing confidentiality.

The software company never joined the discussion, the people said.

The outage, which is still ongoing, affected vital processes including the matching of trades, the calculation of margin calls and regulatory reporting on large market positions.

That left many clients in the dark about whether they were making or losing money, and prompted calls for more collateral, the people said.

It was only then that customers found out there was a problem, with many more only discovering it when Bloomberg News reported the event on Wednesday morning, one of the people said.

‘Isolated’ Problem

On Wednesday, CME, Intercontinental Exchange and Cboe said that their members had experienced issues with a third-party software vendor.

Those issues could affect the timing of publishing exchange reports by the end of the day, the firms said. The London Metal Exchange and Euronext also acknowledged that some of its clients had been affected.

“The LME has been closely monitoring liquidity across all venues since the incident occurred, and has not yet seen any evidence of liquidity being affected,” the exchange said in an emailed statement. “We continue to work closely with affected members to help them continue their business as normally as possible, and reduce any wider impact.”

The issue is “currently isolated to a small number of smaller and midsize firms, and does not pose a systemic risk to the financial sector,” according to a statement from Todd Conklin, deputy assistant secretary of the US Treasury’s Office of Cybersecurity and Critical Infrastructure Protection.

Regulators in the UK, including the Financial Conduct Authority, started looking into the incident, according to people familiar with the matter who asked not to be identified because the matter is private.

The National Cyber Security Centre, part of intelligence agency Government Communications Headquarters, is also involved, the people said.

The Federal Bureau of Investigation is also seeking information on the cyberattack and reached out to ION executives, people familiar with the matter said. The agency is aware of the situation, it said in a statement.

On Thursday evening, the CFTC said the incident was impacting the ability of some clearing members to provide it with accurate data and that it would delay its weekly trading report for the derivatives market until all trades can be reported.

ION told clients on Thursday that its systems won’t be fully operational until Feb. 5, and the firm still hasn’t been able to start several crucial recovery steps, according to email correspondence seen by Bloomberg.

The firm also told broker StoneX that it has brought in “multiple industry leading security firms to assist in their investigations and remediation plans,” according to a copy of the memo sent to clients.

LockBit, the group behind the attack, threatened on Thursday to publish “all available data” that it claimed to have stolen from ION on their website on the dark web unless the derivatives trading platform paid an unspecified ransom by February 4.

It’s unclear if ION paid or plans to pay the ransom, and the industry is still just getting to grips with the ripple effects the incident may have. Beyond clients who are directly affected, banks and brokers that are trading with them aren’t able to match off trades.

The result for now is that derivative shops are turning the clock back by years in an impromptu test of their middle and back offices.

FBI Seeks Information On ION Hack That Disrupted Derivatives

* US Agency Joins UK Regulators In Reviewing The Cyberattack
* ION Told Clients It Won’t Be Fully Operational Until Feb. 5

The Federal Bureau of Investigation is seeking information on the cyberattack on London-based ION Trading UK that’s snarled global derivatives trading, according to people with knowledge of the matter.

The FBI reached out to ION executives and is reviewing how the attack is affecting customers, the people said, asking not to be identified discussing a private matter. The US agency joins UK regulators who have started their own investigations.

“The FBI is aware of this incident and has nothing additional to report at this time,” a representative of the agency said in an emailed statement. The existence of an inquiry doesn’t necessarily mean a criminal probe is under way.

A representative for ION declined to comment.

The attack affected 42 of ION’s clients and forced several European and US banks and brokers to process some derivatives trades manually.

Russian ransomware gang LockBit was behind the incident, according to correspondence from ION seen by Bloomberg, the contents of which were confirmed by a company representative.

Fallout from the hack has flowed through the futures trading industry, as transactions back up and firms struggle to determine their margin requirements to enter or exit positions.

The issue is isolated to a small number of firms, and doesn’t pose a systemic risk to the financial sector, the US Treasury Department said in a statement earlier this week.

Updated: 2-3-2023

Ransomware Attack On Data Firm ION Could Take Days To Fix

(Reuters) – A ransomware attack that hit ION Trading UK could take days to fix, leaving scores of brokers unable to process derivatives trades, sources familiar with the matter told Reuters on Thursday.

ION Group, the financial data firm’s parent company, said in a statement on its website that the attack began on Tuesday.

“The incident is contained to a specific environment, all the affected servers are disconnected, and remediation of services is ongoing,” ION Group said, declining requests for further comment.

Ransomware is a form of malicious software deployed by criminal gangs which works by encrypting data, with hackers offering the victim a key in return for payments. Such ransom demands can total millions of dollars.

Officials on both sides of the Atlantic are monitoring the disruption.

“We’re aware of this ongoing incident and we will continue to work with our counterparts and the firms affected,” Britain’s Financial Conduct Authority (FCA) and the Prudential Regulation Authority (PRA) said on Thursday.

The Federal Bureau of Investigation told Reuters it was also aware of the hack, although it declined further comment. Bloomberg News reported that the FBI had been in touch with Ion executives about the incident.

Among the many ION clients whose operations were likely to have been affected were ABN Amro Clearing (ABNd.AS) and Intesa Sanpaolo (ISP.MI), Italy’s biggest bank, messages to clients from both banks which were seen by Reuters showed.

The Futures Industry Association (FIA) said issues at ION had affected the trading and clearing of exchange-traded financial derivatives, although there had been no reports of margin problems in financial markets.

ABN told clients on Wednesday that due to “technical disruption” from ION, some applications were unavailable and were expected to remain so for a “number of days”.

It added that its staff had to process trades directly with the exchange.

In response to questions from Reuters, ABN said it is not currently seeing any “relevant disruptions”.

“ABN AMRO Clearing has taken appropriate action to keep its operations safe, including informing its clients beforehand on what might happen,” it said in an e-mailed statement.

Intesa Sanpaolo told clients that its brokerage and clearing operations on exchange-traded derivatives had been “severely hampered” by IT problems at ION and that it was not able to handle orders.

The bank told Reuters it was waiting for ION to indicate when it could can restart “normal and safe” operations, adding that the ransomware attack targeting the trading services company had not impacted its own systems.

A source with knowledge of the matter said the attack put brokers that process complex over-the-counter trades involving products such as options in a difficult situation and the problem could take another five days to fix.

The U.S. Commodity Futures Trading Commission said its weekly Commitments of Traders report will be delayed because of the attack until all trades can be reported.

It also said certain reporting firms do not have enough information to fully prepare the daily large trader reports. CFTC reports provide a snapshot of investor positioning on various assets.

Lockbit said it would publish stolen data on Feb. 4 if ION Group failed to pay a ransom, a screenshot of the group’s blog on the dark web on darkfeed.io, a website which tracks ransomware groups, showed.

Lockbit ransomware has been detected all over the world, with organisations in the United States, India and Brazil among the common targets, cybersecurity firm Trend Micro said.

Trend Micro has called the group, which some cybersecurity experts say has members in Russia, “one of the most professional organised criminal gangs in the criminal underground”.

Britain’s National Cyber Security Agency (NCSC), part of Britain’s GCHQ eavesdropping intelligence agency, said it had no immediate comment when contacted by Reuters.

Updated: 3-3-2023

Ransomware Gang In Trading Hack Says Ransom Was Paid

* Ion Trading Representative Declines To Comment On Ransom Claim
* Hack of ION Trading Upended Derivatives Trading Around World

The hacking group behind the attack on ION Trading UK — the software firm that was struck by a cyberattack earlier this week, upending derivatives trading around the world — says a ransom has been paid.

The announcement came a day before the group, called LockBit, threatened to release stolen files from ION unless the extortion payment was made. An ION representative declined to comment.

A representative for the group told Bloomberg News that the ransom was paid and that the gang provided a decryption key to unlock the compromised computers.

The representative didn’t identify who paid the money or the amount that was paid.

Earlier Friday, the timer that LockBit had posted on its website, counting down to a Feb. 4 deadline by which it was demanding ransom from Ion, had been “stopped,” the site showed.

The FBI declined to comment about LockBit’s claim that the ransom was paid.

Ransomware is a type of cyberattack in which a victim’s files are encrypted, in lieu of a ransom payment to unlock them. Many ransomware operators also steal files first and then threaten to release them on their dark web pages, or leak sites, if a ransom isn’t paid.

“Typically, ransomware groups use leak sites to put pressure on the victims to pay,” said Wendi Whitmore, senior vice president and head of Unit 42 at Palo Alto Networks Inc.“Sometimes, the brand reputation risk is enough to coerce the victims to pay the ransom and remove their listing off the leaksite. More often than not, once an organization pays the ransom, they’re removed from the leak site.”

However, Whitmore said there can be other reasons why hackers change their minds and pull down companies from leak sites.

Drew Schmitt, principal threat intelligence analyst at GuidePoint Security, said many hackers go through “levels of pressure” with victim organizations.

“In many circumstances, there are the initial conversations where they prove they have your data, and then threaten to post it to their leak site,” he said. “Before fully posting the victim’s data to the leak site, they will first post their name only.”

In this circumstance, if the client then paid the ransom payment, their name would be removed from the site and nothing further would likely be posted.

“Similarly, if the name and data were posted and then the ransom was paid, their name and information would be removed from the site,” Schmitt said.

But he added, “It’s more or less impossible for us to determine the exact reason why something would be taken down from their site.”

LockBit is among the most prolific ransomware gangs, and its malware was used in attacks against the UK’s Royal Mail in January, shuttering its ability to send international letters and parcels.

LockBit has been active since at least January 2020 and has hacked as many as 1,000 victims globally, extorting at least $100 million in ransom demands, according to the US Justice Department.

The attack on ION Trading began early Tuesday and affected 42 of its clients and ultimately forced some European and US banks and brokers to process some trades manually. The FBI is seeking information about the attack and has reached out to ION executives, according to people familiar with the matter.

Like ION, Bloomberg LP, the parent company of Bloomberg News, provides financial institutions with execution management solutions, connectivity to electronic markets and trading tools.

Updated: 3-25-2023

Ion Derivatives Clearinghouse Hacked In Retaliation For US Government Operation Chokepoint 2.0 #GotBitcoin

ION, and unlisted company based in Dublin, offers data and services to clients in the financial industry, who use its technology to facilitate trading and settlement of exchange-traded derivatives.

The inflicted attack on a section of the group’s operations halted them, affecting some of the world’s biggest bank, brokerages and hedge funds.

A couple of days after the attack, an anonymous benefactor allegedly paid for the ransomware. Neither the company nor the hacker group responded to the request for further comment.

The Ripples Of The Attack Continue To Appear:

* Base metal traders said they had experienced some delays in matching deals, transacted on the London Metal Exchange.

* Brokers had to go old school for recording trades, including entering the data manually in spreadsheets during the ION outage.

* Thousands of firms could have been affected.

FIA – The Futures Industry Association declared on Tuesday that the situation is improving after affected companies have been working closely with ION to get reconnected to the impacted platforms.
Some exchanges and clearing houses offered extensions to allow affected firms to meet clearing and reporting deadlines.

I told you! The world is a global village, regardless of what part it is hit, the ripple effects can be seen all over the place.

This was Olimpiu Pop reporting from Transylvania, Romania. Stay safe! Stay strong!

Bitcoin Information & Resources (#GotBitcoin)

What Is Dopamine Fasting? Meet The Dangerous Fad Among Silicon Valley’s Tech Geniuses

Bitcoin Community Leaders Join Longevity Movement

Sean Harribance Shares His Psychic Gifts With The Public

Scientists Achieve Real-Time Communication With Lucid Dreamers In Breakthrough

Does Getting Stoned Help You Get Toned? Gym Rats Embrace Marijuana

Marijuana’s Money Man

Marijuana In Africa Is Like The Gold Rush For America In The 1800s

The Perfect Wine And Weed To Get You Through The Coronavirus Pandemic Lockdown

Mike Tyson’s 420-Acre Weed Ranch Rakes In $500K A Month