The recent cyberattack on the U.S. affiliate of Industrial & Commercial Bank of China (ICBC) highlights the potential systemic risks facing the financial sector, says Moody’s Investors Service in a new report.
The rating agency warned that the risk of a cybersecurity incident evolving into a systemic threat was evident in the incident involving ICBC’s U.S. affiliate (ICBC FS), which provides global clearing, execution and financing services to institutional clients in equity and fixed income markets.
“The cyber incident appears to have disrupted ICBC FS’s ability to clear its trades in U.S. Treasuries as well as in the Treasury repurchase market, a key short-term U.S. funding market,” Moody’s noted.
The fact that the U.S. Federal Reserve has extended operating hours several times since the incident was made public suggests “some trade-settlement issues related to the incident,” it said.
The report also noted that the volume of failed trades in the U.S. Treasury market seemingly spiked alongside the ransomware event.
The surge in failed trades may indicate “unsettled trading activity” related to the ICBC FS incident and could also indicate “unanticipated counterparty exposure due to the ransomware event,” the report said.
“In this sense, cyber risk may have been transformed into liquidity and counterparty exposure,” it noted.
The fact that the incident didn’t morph into a systemic event was largely due to two factors, Moody’s said: the fact that it was a ransomware attack, instead of a malware attack; and the fact that the institution that was targeted is financially strong.
Had the attack been from malware, “the negative repercussions on highly interconnected global financial institutions active in these markets could have been more widespread and systemic,” the report said.
And if it had struck a weaker financial institution, “the incident could have created knock-on effects to settlement and confidence with potentially broader market effects,” it added.
Information on the true extent of the damage from the incident “will likely emerge over time,” Moody’s said.
“At this juncture, our baseline view is that those losses to ICBC as a whole are manageable though some reputational damage to ICBC FS is possible,” it noted.