ION brings clients back online after ransomware attack - source
By Harry Robertson
LONDON (Reuters) -ION, the financial trading services group hit by a ransomware attack last week, started to bring clients back on to its cleared derivatives platform overnight, a person familiar with the matter told Reuters on Tuesday.
Hacking group Lockbit claimed responsibility for an attack on a section of ION last week, which disrupted customers that include some of the world's biggest banks, brokerages and hedge funds.
Lockbit said last week a ransom had been paid, declining to say how much it was, or offer evidence the money had been handed over. ION declined to comment on Lockbit's statement.
The Futures Industry Association (FIA) said on Tuesday the companies that have been affected have been working closely with ION to get reconnected to the impacted platforms.
ION, an unlisted company based in Dublin, offers data and services to clients in the financial industry, who use its technology to facilitate trading and settlement of exchange-traded derivatives. Last week's attack halted these processes.
A market participant with knowledge of the situation said thousands of firms could have been affected.
The FIA said the situation was improving after some exchanges and clearing houses offered extensions to allow affected firms to meet clearing and reporting deadlines. Clearing is the process of ensuring trades have gone through and the relevant parties are fully settled up.
"We have been told that the need for clearing extensions has diminished and exchanges are reporting business as usual," an FIA spokesperson said, who added they were not aware of any serious impact on markets.
The FIA represents global market participants in derivatives markets.
GOING OLD SCHOOL
The attack on ION had an impact on market participants. Sources with knowledge of the situation said brokers had to resort to outdated methods of recording trades, including entering them manually in spreadsheets during the ION outage.
The U.S. Commodity Futures Trading Commission, a regulator, delayed publication of weekly trading statistics because some affected ION customers were not able to collate information fast enough to compile daily positioning reports.
The ripples continued on Tuesday.
Two base metal traders said they had experienced some delays in matching deals transacted on the London Metal Exchange (LME). Deal matching means connecting buyers and sellers on an exchange.
Among the many ION clients whose operations were likely to have been affected by the attack and ensuing disruption were ABN Amro Clearing and Intesa Sanpaolo, Italy's biggest bank, according to messages to clients from both banks that were seen by Reuters last week.
Britain's Financial Conduct Authority said it continued to monitor the situation.
(Reporting by Harry Robertson; Additional reporting by Pratima Desai, Eric Onstad, Raphael Satter and Danilo Masoni; Editing by Amanda Cooper and Bernadette Baum)
