ION Trading ransomware attack update

This content has been archived. But, the content is true and relevant to the underlying technology products or infrastructure services.

ION Group is a financial conglomerate that offers financial services on the stock markets. On 31st January 2023, ION Market was subject to a ransomware attack. We look at the details of this cyber event and the subsequent response of the company.

Key points about the ION Market ransomware attack

• On 31st January 2023, ION Markets became a victim of a ransomware attack.
• This attack affected the operations of the ION Cleared Derivatives services.
• The impact was felt on the stock exchanges that use the ION Cleared Derivatives services. The cascading effect was seen in many financial institutions.
• ION Group was added to the victim list of Lockbit 3.0 on 2nd February 2022. It allowed a single day for the ION Trading Group to fulfill the ransom demands.
• On 4th February, Lockbit 3.0 dropped all references to the ION Group. This is an indication that the victim reached a settlement with the ransomware group. Some or all ransom would have been paid to recover encrypted data.
• As of 9th February, the Cleared Derivatives division of the ION Group is restoring services to the Banks and financial institutions.
• Some banking companies have confirmed the normalized resumption of ‘Cleared Derivatives’ services at the ION Trading group.

It looks like ION Trading’s ransomware incident has been resolved. There is a strong likelihood of ransom being paid to reinstate business operations at ION Trading’s ‘Cleared Derivatives’ division.

Interestingly, the ION Trading Group released an initial statement on 31st January 2023. The brief statement is listed below:

ION Cleared Derivatives, a division of ION Markets, experienced a cybersecurity event commencing on 31 January 2023 that has affected some of its services. The incident is contained to a specific environment, all the affected servers are disconnected, and remediation of services is ongoing. Further updates will be posted when available.

ION Group Press statement

There has been no further statement on this ransomware attack by the ION Market group.

The screenshot below shows that Lockbit 3.0 did execute a ransomware attack against the ION Market or ION Trading group.

About ION Market Group

ION Group is a multi-disciplinary financial services company. It has a presence in 17 office locations all across the United States. It also provides financial services all over the world.

Within the ION Group’s offerings, ION Markets is a specialized financial arm of the company. It offers financial services in the following domains:

• Asset Management
• Fixed income solutions
• Cleared Derivatives
• Equities
• Foreign Exchange
• Secured Funding

In this ransomware incident, data and computers of the ‘Cleared Derivatives’ division were encrypted and impacted by the Russia-based ransomware group. As of 9th February 2023, this ransomware incident is resolved.