LockBit ransomware attack on ION Group disrupted global derivatives trading

ION Group, a financial software company whose products automate trading and post-trade work for banks and brokerages, disclosed on January 31, 2023 that ransomware had struck its ION Cleared Derivatives unit, part of ION Markets. The LockBit gang claimed responsibility, added the company to its leak site and threatened to publish stolen files on February 4.

The affected software automates post-trade processing and clearing. With it offline, financial institutions in Europe and the United States had to complete those steps by hand, which delayed time-sensitive work such as updating margin requirements on trades. TechCrunch reported that at least 42 ION clients were affected, and that some commercial banks had trouble obtaining trading quotes.

The Futures Industry Association said it was working with affected members, including clearing firms and exchanges, as well as market regulators, to assess the impact on trading, processing and clearing.

ION said the affected servers had been disconnected and that remediation of services was under way. According to TechCrunch, the company indicated systems would not return to full operation until February 6. U.S. Treasury officials played down systemic risk, characterising the disruption as affecting a small number of smaller and mid-size firms. ION did not say publicly whether a ransom was demanded or paid.