Three seats at ICBC’s ransomware attack, and the plan each one needed

The week

On the morning of November 8, 2023, staff at ICBC Financial Services found that some of their systems had stopped working. The firm is the U.S. broker-dealer arm of the Industrial and Commercial Bank of China, which means it buys and sells securities for clients and for itself, including U.S. Treasury bonds, the government debt that the global financial system treats as its safest asset.

The Associated Press described the New York-based firm as handling trades and other services for financial institutions. Its parent is China’s biggest bank. That combination, a mid-sized U.S. dealer backed by a very large foreign parent, would shape how the episode was resolved.

The cause was ransomware. Ransomware is malicious software that criminals slip into a company’s network; once inside, it scrambles (encrypts) files and systems so they cannot be used, and the criminals then demand payment for the key to unscramble them. The LockBit ransomware group, one of the most active criminal operations of that period, was widely reported to be responsible.

LockBit was not a single gang so much as a franchise. Its operators built and maintained the encryption software and a website for publishing stolen data, and they rented both to affiliates who carried out the intrusions in exchange for a share of ransoms. The Associated Press, citing the security firm Emsisoft, described LockBit as active since September 2019 and responsible for attacks on thousands of organizations.

The group had been busy that autumn. Boeing had confirmed a cyber incident affecting elements of its parts and distribution business on November 1, after LockBit listed the company on its leak site. Two weeks after the ICBC attack, CISA and the FBI issued a joint advisory warning that LockBit affiliates were exploiting a flaw in Citrix remote access appliances, known as Citrix Bleed. Citrix had released fixes for it on October 10. The advisory did not name ICBC, and the firm’s point of entry was not publicly confirmed.

The timing mattered because the bond market runs on deadlines. When a firm agrees to buy or sell Treasuries, the trade has to “settle” — the cash and the securities actually have to change hands — on a fixed schedule, usually the same day or the next. The same is true of repo trades, short-term loans in which one party hands over Treasuries as collateral in exchange for cash. A firm whose systems are locked still owes everything it promised yesterday.

In a statement the next day, ICBC Financial Services said it had disconnected and isolated the affected systems to stop the damage spreading. It said it had cleared the U.S. Treasury trades executed on November 8 and the repo financing trades done on November 9.

The statement added a few details that mattered to anyone assessing the damage. The firm said it was investigating and had reported the incident to law enforcement. It also said its business banking, email and other systems had not been affected. That suggested the encrypted systems were a defined part of the environment rather than the whole firm, a distinction that would shape how counterparties judged the risk of staying connected.

Behind that calm statement, reporting at the time described a messier picture. The firm was described as temporarily owing a large sum to its settlement bank, the bank that moves cash and securities on its behalf. Some market participants rerouted or delayed trades rather than deal with a firm in trouble. SIFMA, the industry association for securities firms and banks, kept its members informed as the situation developed.

The attack landed in a fortnight of regulatory activity on cyber risk in New York. On November 1, the New York State Department of Financial Services had finalized amendments to its cybersecurity regulation for the banks, insurers and other firms it licenses. Among other changes, the amended rule required covered entities to notify the department within 24 hours of making an extortion payment and to explain within 30 days why the payment was necessary. It had no bearing on ICBC’s handling of the incident, but it showed regulators turning their attention to the ransom decision itself.

Washington paid attention too. The U.S. Treasury said it was in regular contact with financial sector participants and federal regulators, and Treasury Secretary Janet Yellen said the department had not seen an impact on the Treasury market. She spoke on November 10 in San Francisco, where U.S. and Chinese finance officials were meeting ahead of a regional economic summit, and the attack came up in those discussions. The episode was short, but it showed how one mid-sized firm, hit by a common criminal tool, could send ripples through the plumbing of the world’s most important bond market.

ICBC Financial Services was a meaningful participant in the Treasury and repo markets, but it was not a dominant one, which makes the episode worth studying. A firm of that size, hit by a common ransomware group using familiar methods, still briefly disturbed settlement in the world’s most important bond market. If a non-dominant player can cause that kind of ripple, every firm in the system needs to think about what happens when the trouble is next door, or in its own building.

In the ION attack of early 2023, the weak point had been a shared post-trade vendor, a software company that many firms relied on to process trades after they were agreed. Here the weak point was a market participant itself, and the incident looked very different depending on where a firm sat.

There are three seats, and between them they cover everyone involved: the firm that was hit, the counterparties deciding whether to keep trading with it, and the settlement bank carrying its obligations. Any broker-dealer or bank can occupy each of them, sometimes in the same week, so each needs its own plan. The mechanics come first, then each seat in turn.

Ransomware meets the settlement clock

Start with the attack itself. Ransomware is not a single program but a business model. Criminal groups such as LockBit develop the malicious software and rent it out to “affiliates,” who do the work of breaking into victims’ networks, often through a stolen password, an unpatched server or a convincing phishing email. Once inside, the attackers spread from machine to machine unnoticed, then trigger the encryption all at once. Increasingly they also copy sensitive data before locking it, so they can threaten to publish it if the victim refuses to pay.

For most companies, ransomware is a painful outage. For a trading firm, it collides with something the market never pauses: settlement. When two firms agree a trade in Treasuries, the agreement is only a promise. Settlement is the moment the promise is kept, when the seller delivers the bonds and the buyer delivers the cash. In the Treasury market this happens on tight, fixed timetables, typically the same day or the next.

Repo adds another layer. A repurchase agreement, or repo, is a short-term loan dressed up as a sale: one firm sells Treasuries to another for cash and agrees to buy them back shortly afterward at a slightly higher price. The difference is, in effect, interest. Repo is how much of the financial system funds itself overnight, so a repo trade that fails to settle means someone, somewhere, does not get the cash they planned to use that morning.

Overnight repo also has to be renewed. A dealer that funds its bond inventory with repo borrows afresh each morning, rolling yesterday’s loans into new ones. A firm that cannot instruct its trades cannot roll that funding. Its lenders are left holding collateral instead of being repaid, and the firm itself has positions to finance with no ready source of cash. The settlement problem and the funding problem arrive together.

Finally, there is the settlement bank. Most broker-dealers do not move cash and securities through the central plumbing on their own. They use a bank that does it for them and that, during the day, may front the money when the timing of incoming and outgoing payments does not line up. That short-term lending is called intraday credit. It is normally routine and invisible. In a crisis, it becomes the place where one firm’s problem turns into another firm’s exposure.

What a failed delivery costs

A settlement fail is not free. Since 2009, the Treasury Market Practices Group, an industry group sponsored by the Federal Reserve Bank of New York, has recommended a charge on fails to deliver Treasury securities. The charge makes failing costly even when interest rates are low, so firms cannot treat a late delivery as a cheap loan. A firm that cannot deliver pays it, and so does a firm whose own delivery depended on receiving securities from the troubled firm first.

That chain effect is what makes one firm’s outage spread. A dealer that expected to receive bonds from the victim and pass them to a third party now fails to the third party as well. Each link in the chain needs either to find the securities elsewhere, borrow them, or accept the fail. In a market where the same securities change hands many times a day, a few large fails can ripple outward before anyone has a full picture.

The rules each seat answers to

The three seats sit under different regulatory regimes, and a plan has to be precise about which applies. Broker-dealers answer to the SEC and FINRA. FINRA Rule 4370 requires member firms to maintain a business continuity plan covering data backup, mission-critical systems and communications with customers and regulators, reviewed every year. In May 2024 the SEC also amended Regulation S-P to require broker-dealers and certain other firms to keep an incident response program. In most cases they must notify affected customers within 30 days when their sensitive information is reached without authorization.

Banks answer to different rules. Since 2022, a federal interagency rule has required banking organizations to notify their primary federal regulator within 36 hours of determining that a significant computer-security incident has occurred. The same rule requires bank service providers to notify their bank customers as soon as possible when an incident disrupts covered services for four hours or more. Market infrastructure such as clearing agencies falls under the SEC’s Regulation SCI, which does not cover an ordinary broker-dealer. State-licensed firms in New York also carry the Department of Financial Services’ notification duties.

No single rule tells a firm how to behave in all three seats at once. Each rule addresses one firm’s own resilience and reporting. The coordination problems between firms, which shaped the ICBC episode, are left mostly to contracts and industry frameworks.

Put those pieces together and the shape of the November 2023 problem is clear. A firm whose systems were locked still had trades that had to settle, counterparties who were nervous about being connected to it, and a settlement bank waiting for instructions and funds that might not come on time.

Seat one: the firm that was hit

Full recovery from ransomware takes weeks. Systems have to be investigated, cleaned or rebuilt, and tested before anyone trusts them again. Settlement obligations, by contrast, fall due the same day or the next. The victim’s urgent problem is therefore narrower than recovery: what is the minimum capability needed to confirm and settle outstanding positions, and how fast can it run from infrastructure the attacker never touched?

Reports that the firm resorted to manual and improvised means to pass transaction details to others show what happens when that question has no prepared answer. Improvisation can work for a day. It is slow, error-prone, and exactly the kind of unusual activity that fraudsters try to exploit.

Containment against continuity

The first hours bring a direct conflict. The security team wants to isolate everything the attacker might reach, which is the right instinct for stopping encryption from spreading. Operations needs some connections to stay up so that today’s trades can settle. A firm that has not decided in advance which links to preserve will either cut too much and fail its obligations, or keep too much open and risk reinfection.

The answer is a pre-agreed isolation order. It lists which systems and connections are cut first, which are cut only on confirmed compromise, and which minimal paths are kept for settlement under heightened monitoring. ICBC Financial Services’ statement that its banking and email systems were unaffected suggests some separation was in place. Separation built before an attack is what makes that kind of statement possible.

The ransom decision

The victim also faces a decision that no continuity plan can make for it: whether to negotiate. The decision belongs with senior management and the board, advised by counsel and law enforcement, not with the technology team alone. Treasury’s Office of Foreign Assets Control has warned that paying a ransom to a sanctioned person or group can violate sanctions law. Knowing who is on the other side is therefore part of the decision. Paying also does not restore systems quickly. Decryption is slow, and the network still has to be cleaned and rebuilt.

Different firms, different minimums

The minimum capability depends on how a firm is built. An introducing broker that clears through another firm on a fully disclosed basis has handed most settlement to its clearing firm. Its minimum is the ability to stop new orders, communicate with customers and confirm its positions with the clearing firm. A self-clearing dealer active in Treasuries and repo needs everything described above, because it instructs settlement directly. A bank-affiliated dealer may be able to borrow capability from its parent, but only if the parent’s systems are clearly outside the attacker’s reach.

A minimum viable settlement capability has three ingredients.

• Data. A record of open positions and obligations that can be rebuilt from sources outside the compromised network, such as clearing statements, settlement bank reports and counterparty confirmations. If the only copy of “what we owe and to whom” lives on the systems that were just encrypted, the firm is flying blind.
• A clean environment. A small set of devices, accounts and connections kept separate from the main corporate network and its central login system (often called the domain), enough to run confirmations and instruct the settlement bank. It works like a lifeboat: small, stocked in advance, and launched from a different deck from the one on fire.
• People. Named staff who know the manual procedures and are authorized to use them. In a crisis, “someone in operations will figure it out” is not a plan. Two or three specific people, with deputies, who have practiced the routine are.

Talking to the market

The victim’s second urgent task is communication. Counterparties, the settlement bank, clearing organizations, regulators and customers all want answers at once, and each will act on rumor if no answer comes. A firm should name one person to own external status updates, set a schedule for them, and use channels it is confident the attacker does not control. Telephone calls to known numbers and pre-arranged contacts at each major counterparty work when corporate email cannot be trusted.

The content of the updates matters as much as their timing. Counterparties need to know which connections are affected, which trades the firm can still settle and by what route, and when forensic evidence is expected. A short, factual update every few hours does more to keep counterparties trading than reassurance without detail. Silence pushes them toward disconnection.

Customers need a separate track. A broker-dealer’s clients want to know whether their orders were executed, whether their assets are safe and whether their personal information was taken. If it was, Regulation S-P’s notice duties may apply, and the answers given in the first days will be compared later with what the investigation finds. Statements should be accurate before they are reassuring.

Regulators already expect some of this thinking. FINRA, the self-regulatory body that oversees broker-dealers, already requires member firms to maintain business continuity plans. Many of those plans, though, are written around a building being unavailable or a data center going dark, situations where systems are unreachable but intact. A ransomware scenario is different: the primary environment is unusable, and possibly still hostile. That scenario deserves explicit treatment within the plan, and an annual test with the clearing and settlement providers who would be on the other end of the phone.

A clean environment that stays unused also decays. Its devices miss patches, its accounts expire, and the settlement bank’s portal changes its sign-in process. It needs its own identity accounts and multi-factor authentication, separate from the corporate directory. It also needs a quarterly check that each device starts, connects and reaches the settlement bank.

Suppose a mid-sized broker-dealer’s continuity plan says that if headquarters is lost, staff will work from a backup site and log in to the same systems. On a ransomware morning, that plan is useless, because the systems themselves are the problem. A better plan says: three laptops that never join the main network, kept in a locked cabinet; a separate set of accounts with the settlement bank; a daily file of open positions sent to a secure location outside the firm; and a call list that the head of operations can run from a personal phone.

Industry initiatives have tried to make the data ingredient routine. Sheltered Harbor, a standard developed by U.S. banks, credit unions and brokerage firms, has members keep protected, unchangeable copies of critical customer account data outside their main systems. Its focus is restoring customer balances rather than settling trades. The principle carries over: the record of what a firm owes should exist somewhere the attacker cannot encrypt it, in a form that can be read without the firm’s own systems.

Seat two: the counterparties deciding whether to keep trading

When a firm is known to be compromised, every firm connected to it faces an uncomfortable choice. Keep the connections open, and risk the attackers using those links to spread into your own network. Cut them, and lose the ability to transact with a firm you still have trades with. Reports from November 2023 described firms disconnecting from ICBC Financial Services as a precaution. The instinct is sensible, and it adds to the disruption, because each cut connection is a trade that must be settled another way.

“Connections” here means the many technical links between firms: automated file transfers that carry trade details, email, messaging systems used to confirm trades, and the settlement messaging that tells banks what to move. These links are what make modern markets fast. They are also paths an attacker can try to walk down.

Two decisions need prior authority, meaning someone has been given the power to make them before the day arrives.

Disconnection should be pre-approved by connection type. File transfers and email links can be suspended by the security team at once, without waiting for a meeting. Settlement messaging is different: obligations continue whether or not the link is up, so cutting it may need sign-off from operations leadership, who understand which trades will then need another route.

Reconnection is harder, because nobody wants to be the first to let a recovering firm back in. If the attacker is still lurking, the firm that reconnects first takes the risk. A counterparty should therefore know in advance what evidence it will accept. Typical items are a third-party forensic firm’s statement that the attacker has been removed, confirmation that credentials and keys used on shared connections have been rotated, meaning changed so that old copies no longer work, and a description of the rebuilt environment.

SIFMA had published a reconnection framework for exactly this purpose in 2020 and issued an updated edition in November 2023. The framework helps only if a firm has mapped it to its own connection inventory, with an owner for each link who can apply the evidence test and record the decision. Without that map, reconnection decisions default to whoever is most anxious, and the recovering firm faces a dozen different sets of questions instead of one.

Not every connection carries the same risk

A connection inventory is more useful when it ranks links by risk. An outbound file transfer that sends confirmations to the troubled firm carries less risk than an inbound one that loads its files into your systems. A shared virtual private network or an interactive portal, where the other firm’s users act inside your environment, carries the most. Email sits in the middle, a channel attackers routinely use to send convincing messages from a real partner’s domain.

Reconnection can follow the same ranking. Low-risk, outbound links can come back first, once basic evidence arrives. Inbound and interactive links need the full evidence set and, often, new credentials and fresh network rules. Phasing reconnection this way lets trading resume sooner while keeping the riskiest paths closed until trust is rebuilt.

The counterparty’s own exposure

Counterparties also have a financial problem to manage. Trades with the troubled firm may fail, which means expected cash or securities do not arrive. An asset manager counting on repo cash for the morning needs another source of funding. A dealer that expected bonds needs to borrow them or accept a fail on its own onward delivery. A counterparty plan should therefore name the funding and securities lending alternatives it would use if a major counterparty went dark, and the person authorized to use them.

The decision to keep trading at all is a credit and reputational judgment as much as a technical one. A firm that refuses all new business with a recovering counterparty protects itself in the short run, but adds to the pressure that turns an operational incident into a liquidity problem. Larger firms with many connections and strong security can sometimes afford to stay connected through a hardened path. Smaller firms with thinner security teams often cannot, and their plans should say so plainly.

Take an asset manager that trades with that broker-dealer. If it has a list of its twelve connections to the firm, each with a named owner and a pre-agreed evidence checklist, it can say yes or no in hours. If it has no such list, the decision goes up to the chief risk officer, who asks the security team, who ask the vendors, and a week passes while trades are settled by hand.

Seat three: the settlement bank carrying the obligations

Treasury settlement runs through a small number of clearing banks and, for part of the market, central clearing, where a single clearing house stands between buyer and seller. When a participant cannot deliver cash or securities on time, its settlement bank may extend intraday credit to bridge the gap. That exposure can grow very quickly in a market that settles enormous volumes daily. In this case the gap was reportedly closed after the parent provided capital. A settlement bank cannot count on a well-capitalized parent every time.

The settlement bank’s plan has three parts.

1. Credit terms that anticipate operational failure. Credit limits and collateral terms for clients are usually designed around the risk that a client becomes financially weak. They should also anticipate operational failure, where a perfectly solvent client simply cannot process. There should be a clear point at which the bank stops extending credit to a client that cannot process, agreed in advance rather than argued about at four in the afternoon.
2. A way to trust unusual instructions. Operations staff need a procedure for receiving instructions from a client whose systems are down, including how to authenticate a request arriving by unusual means, such as a phone call, a personal email or a fax. Fraud attempts follow at exactly such moments. Criminals read the news too, and a message saying “our systems are down, please wire the funds to this account instead” is a classic move.
3. Its own line to the outside world. The bank needs a communication path with supervisors and the wider market that does not depend on the troubled client. If the bank is waiting for the victim to explain what is happening, it will be the last to know.

Verification procedures for unusual instructions are simple to write and easy to skip under pressure. They include calling back on a number registered before the incident, never one supplied in the message, and requiring two people to approve any change to payment details. Some firms also agree a code word or reference with each client in advance. The procedure should apply most strictly on exactly the days when clients are most insistent that it be relaxed.

The settlement bank also has its own reporting duties. A client’s outage may disrupt the bank’s own operations or expose it to material loss. The bank then has to judge whether it has a notification incident under the federal banking rule, with its 36-hour clock. That judgment is easier when the bank has already agreed with its supervisors who will call whom, and when its credit and operations teams share one running record of the exposure through the day.

This seat is the one most likely to turn an operational incident into a financial loss. A regional bank that provides settlement services to a dozen broker-dealers should be able to answer a simple question: if our largest client went dark at nine in the morning, how much could we end up owing on its behalf by the close, and who decides when to stop?

How intraday credit grows

The mechanics explain why the exposure can grow so fast. A settlement bank delivers securities and cash on its client’s behalf through the Federal Reserve’s Fedwire services and other systems. When a client’s purchases settle before its sales, the bank pays out first and expects to be repaid as the day goes on. If the client cannot send instructions to settle its sales, the incoming cash never arrives, and the bank is left funding the purchases.

Clearing agreements usually give the bank rights over the client’s securities and other collateral to cover that exposure. Those rights help, but using them is slow and public, and selling collateral in a hurry can itself disturb the market. The more practical protection is a credit limit for operational failure that is low enough to stop the problem growing, set before the day arrives.

Different settlement banks, different plans

The seat looks different at different institutions. A large custodial bank serving many dealers has deep operations teams and direct relationships with supervisors, but its exposure to any one client can be very large. A regional bank providing correspondent settlement to a handful of smaller broker-dealers has less exposure in dollars but also fewer staff to run manual procedures. A bank that sponsors fintech firms into the payment system faces a version of the same problem with a different product. Each needs a plan scaled to its book, but all need the same three parts.

What reaches the boardroom

The episode can look like a story for back-office specialists, but each seat touches the things boards and executives are accountable for.

• Money. Failed or delayed settlement can mean penalty charges, emergency funding costs and, for a settlement bank, credit exposure that appears in hours.
• Customers. Clients whose trades are delayed remember who was reliable and who was not, long after the systems are restored.
• Regulators. Treasury, federal regulators and FINRA all have an interest in how firms handle a disruption like this, and a firm that cannot explain its plan will find the conversation uncomfortable.
• Reputation. The market noticed which firms disconnected, which kept trading and which were in trouble. Those impressions shape who gets called next time.

The case that the system worked

A reasonable reader could draw the opposite conclusion. Trades settled, the market functioned, Treasury reported no impact, and the problem was solved within days. On that reading, the episode shows the existing safeguards working as designed, and further preparation is a cost without a clear benefit.

That reading leaves out how the problem was solved. Reporting at the time described the gap being closed after the parent provided capital, an option that depended on a very large parent willing to act quickly. A firm without that backstop, or one hit on a day of market stress, would have had fewer choices. The episode also involved a firm that was not dominant. A larger participant, or several firms hit by the same affiliate at once, would test the plumbing harder. The argument for preparation rests on those scenarios, not on the one that happened.

What insurance does and does not cover

Boards often assume cyber insurance will absorb the cost. Policies vary widely, and the details matter. Many cover forensic investigation, legal advice and some business interruption losses, often with sublimits and waiting periods. Insurers may require the use of approved forensic and legal firms, and getting approval can take time in the first hours. Fail charges, emergency funding costs and losses from fraudulent instructions may fall outside cover. Firms should ask their broker and counsel to map each seat’s likely costs against the policy before an incident, not after one.

The deeper point is that interconnection cuts both ways. The same links that let a firm trade efficiently are the ones it will need to decide about, in a hurry, when a neighbor is compromised.

Unglamorous preparation

Sound preparation is surprisingly unglamorous: a short document, a few locked-away laptops, a spreadsheet of connections with owners’ names next to them, and a practiced phone tree. The organizations that cope best are rarely the ones with the most sophisticated tools. They are the ones that made the small decisions in advance.

The evidence examiners ask for

Examiners and auditors will ask for the paper behind these decisions. For a broker-dealer, that means a continuity plan with an explicit ransomware scenario, the annual review FINRA requires, and test results showing the minimum settlement capability works. It also means the connection inventory with owners, the decision-rights matrix for disconnection and reconnection, and after-action reports from tabletop exercises with the gaps found and closed. For a settlement bank, it means credit terms that address operational failure and procedures for verifying unusual instructions.

A few measures show whether preparation is real. Useful ones are the time taken to rebuild a list of open positions from outside sources, and the share of connections with a named owner and evidence checklist. Another is the time needed to bring up the clean environment from a cold start. Each can be tested in a drill and reported to the board each year. Backups deserve their own test: whether a restore works when the main identity system is assumed compromised.

The failures are just as predictable. Firms treat ransomware as an IT problem, when the technology team can rebuild systems but cannot decide whether to keep trading with a counterparty or how much credit to extend. They plan for a lost building rather than a hostile network, assuming the systems are fine and the people cannot reach them, which is the reverse of ransomware. They keep backups and recovery tools inside the blast radius, on the same network with the same logins, where they are often encrypted along with everything else. They leave reconnection to judgment on the day, so anxious people default to “not yet” and the disruption lasts longer than it needs to. And they forget the fraudsters: every crisis brings opportunists, and unusual instructions need extra verification precisely when everyone is in a hurry.

When the obvious response causes harm

Several sensible responses carry costs that fall on someone else. Mass disconnection protects each counterparty but starves the victim of the links it needs to settle, which raises the risk of fails across the market. Strict reconnection demands protect the demanding firm but can keep a cleaned-up victim isolated for days. Inside the victim, the forensic team wants systems preserved as evidence while operations wants them rebuilt at once. A plan that names these tensions and assigns someone to decide each one prevents them from being settled by whoever argues loudest.

Rehearse all three seats at once

Every large firm should run one tabletop exercise that moves through all three seats. A tabletop is a structured rehearsal around a table, not a technical test: people talk through what they would do, hour by hour, as a facilitator introduces new developments. Assign one team the victim’s role, another the counterparties, and a third the settlement bank, and play the first trading day.

The friction points, such as which evidence the counterparties demand and whether the victim can produce it, show up within the first hour. The victim team discovers it cannot produce a forensic statement on day one. The counterparty team discovers it does not know how many links it has. The settlement bank team discovers nobody has decided when to stop extending credit. Each of those gaps can be closed after the exercise, before a real incident exposes it.

Running the exercise

The exercise works best with the people who would actually make the calls. That means operations, treasury, legal, compliance, communications and security, plus the relationship managers who deal with the settlement bank and major counterparties. A facilitator runs a timeline of developments: a forensic report that is late, a counterparty that disconnects, an instruction from an unfamiliar email address. By mid-afternoon, a credit limit is close to being reached.

Internal exercises reach only so far, because the friction lies between firms. Inviting the clearing firm or settlement bank to play its own part, at least every other year, tests the joints that matter most. Industry-wide exercises such as SIFMA’s Quantum Dawn series offer another venue, and a firm that takes part should bring back specific gaps rather than general lessons. The output of every exercise should be a short list of decisions, each with an owner and a date.

Each hard decision of a ransomware morning needs an owner in advance

• If our main systems were encrypted tomorrow morning, could we tell our settlement bank, by noon, exactly what we owe and to whom, and from what source?
• Who, by name, is authorized to run manual settlement procedures, and do they have devices and accounts the attackers could not reach?
• How many technical connections do we have to each major counterparty, and who can cut each type without asking permission?
• What evidence would we need to see before reconnecting to a firm that had been hit, and have we written it down?
• If we provide settlement services, at what point do we stop extending credit to a client that cannot process, and how would we verify its urgent instructions?

With hindsight

The disruption was short, and the market absorbed it. That outcome is reassuring, but it is not the same as proof that the system is ready for the next one, and the years that followed showed regulators and the industry still working on the problem.

In December 2023 the SEC adopted rules requiring more Treasury cash and repo transactions to be centrally cleared, with compliance dates later extended to the end of 2026 and mid-2027. Central clearing means a single clearing house stands in the middle of trades, so that each firm faces the clearing house rather than each other. That addresses counterparty credit risk, the risk that the other side cannot pay, more than operational risk, the risk that the other side simply cannot function. It also moves settlement concentration toward the clearing house rather than removing it. New market structure does not retire the three seats; it rearranges who sits in them.

In February 2024 an international law enforcement operation disrupted LockBit’s infrastructure, though the group and its affiliates did not disappear. Ransomware is a business model with many operators, and taking down one brand changes the names on the threat reports more than the threat itself. Planning should assume another group, using similar methods, will try again.

The pressure on LockBit continued. In May 2024, the United States, the United Kingdom and Australia named and sanctioned a Russian national, Dmitry Khoroshev, whom they identified as the group’s administrator, and U.S. prosecutors unsealed an indictment against him. Sanctions also changed the ransom calculation for any victim. A payment to a sanctioned person carries legal risk under OFAC rules, which removes one option many victims had treated as a last resort.

The third seat was tested again in a different form. In mid-2024 Evolve Bank & Trust, a bank that provided banking services to a number of fintech companies, disclosed a data breach that LockBit claimed. Several of the fintechs that relied on it had to tell their own customers. The pattern was familiar: one institution’s incident became a problem for every firm that depended on it, and each had to decide what to trust and what to tell its customers.

SIFMA and the Financial Services Sector Coordinating Council published a further update to the reconnection framework in December 2025, a sign that the counterparty seat remained the least settled of the three. The technical recovery of a single firm is hard but well understood. Deciding collectively when to trust that firm again is a coordination problem, and coordination problems are solved by agreeing rules in advance, not on the day.

Rules on customer notice moved too. The SEC’s May 2024 amendments to Regulation S-P gave larger broker-dealers and investment advisers until December 2025 to comply, and smaller ones until June 2026. By this point in 2026 those firms are expected to run incident response programs and to tell affected customers within 30 days when their sensitive information is compromised. That adds a fourth clock to the first days of a ransomware incident, alongside settlement, regulatory notice and reconnection.

Non-malicious events made the same case. The faulty CrowdStrike software update of July 2024 disabled Windows systems at many firms at once, including banks and market participants. It was no attack, but it posed the questions this article raises. Firms had to settle with impaired systems, decide whom to trust, and work out which counterparties could still process.

Three conclusions follow. First, a short incident is not the same as a contained risk; it may simply mean someone stepped in to absorb the cost. Second, the decisions that matter most in the first hours, who disconnects, who reconnects, who extends credit, are business decisions that should already have owners. Third, rehearsal reveals gaps that documents hide.

The public record has gaps of its own. Little has been published about how individual firms handled their connections to ICBC Financial Services that week, and the public account still rests largely on press reports and the firm’s brief statements. Lessons from incidents in this market tend to travel through industry groups and supervisors rather than public post-mortems. That is one reason shared frameworks, such as SIFMA’s, matter more here than in industries where incident reports are routinely published.

The same reconnection problem arose when ransomware struck a healthcare clearinghouse in 2024: the question of when to let a recovering partner back in is not unique to finance.