Cyber Incident Victim: ION Group
Date:
Jan 2023
Location:
United Kingdom
Summary
A ransomware attack by the LockBit gang targeted ION Group's Cleared Derivatives division, disrupting services and forcing major US and European customers to manually process trades, causing operational delays. The incident prompted coordination by the FIA with affected members, exchanges, and regulators to assess impacts on trading and clearing. LockBit claimed data theft during the intrusion and threatened to leak stolen files, potentially exposing sensitive investor information. The company contained the attack by disconnecting affected servers and initiated service remediation efforts.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 8 motives | 3 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On January 31, 2023, ION Group, a UK-based software provider for financial institutions, disclosed a cybersecurity incident impacting its Cleared Derivatives division under ION Markets. The LockBit ransomware gang subsequently claimed responsibility for the attack, listing ION Group on its data leak site and threatening to publish stolen data by February 4. ION Group confirmed the event was contained to a specific environment, with all affected servers disconnected, and stated that service remediation efforts were ongoing. The company did not initially disclose operational specifics but acknowledged disruptions to some services. The incident forced major financial sector clients in the United States and Europe to revert to manual trade processing, leading to significant operational delays. This manual workaround impacted derivatives trading workflows reliant on ION’s automated systems, though the full scope of affected customers was not detailed.
The attack’s repercussions extended beyond ION Group’s infrastructure, prompting the Futures Industry Association (FIA) to coordinate crisis response among exchanges, clearing firms, and regulators. FIA facilitated information sharing through regular calls to assess trading, processing, and clearing disruptions while addressing concerns about regulatory compliance deadlines. LockBit’s data leak threat introduced additional risks of exposing sensitive investor information, though ION Group did not publicly confirm the validity of the ransomware gang’s data theft claims. BleepingComputer contacted ION Group for clarification on the investigation’s findings but received no immediate response. No further details emerged regarding the attack vector, initial access method, or specific systems compromised beyond the Cleared Derivatives environment.