{"id":21191,"date":"2023-02-08T16:10:35","date_gmt":"2023-02-09T00:10:35","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2023\/02\/08\/news-14923\/"},"modified":"2023-02-08T16:10:35","modified_gmt":"2023-02-09T00:10:35","slug":"news-14923","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2023\/02\/08\/news-14923\/","title":{"rendered":"ION starts bringing customers back online after LockBit ransomware attack"},"content":{"rendered":"

ION Group, a financial software firm, is reportedly<\/a> beginning to bring clients back online after being hit by a ransomware attack late last week.<\/p>\n

The Russian-linked LockBit ransomware group claimed<\/a> responsibility for attacking<\/a> a division of ION Group, which affecting 42<\/a> clients in Europe and the United States. The incident forced several banks and brokers to process trades manually.<\/p>\n

The subsidiary, ION Cleared Derivatives, which offers software for automating the trading cycle and the clearing process for derivatives, released a very short statement<\/a> regarding the “cybersecurity event” on Tuesday.<\/p>\n

\n

The incident is contained to a specific environment, all the affected servers are disconnected, and remediation of services is ongoing. Further updates will be posted when available.<\/p>\n<\/blockquote>\n

In a statement last week, Deputy Assistant Secretary of the Treasury’s Office of Cybersecurity and Critical Infrastructure Protection Todd Conklin was quoted<\/a> saying the disruption to Cleared Derivatives’ platform does not pose a “systemic risk to the financial sector”, adding that the incident is isolated to a small number of smaller and mid-size firms. “We remain connected with key financial sector partners, and will advise of any changes to this assessment,” he further said.<\/p>\n

\"\"
The ION Group leak site post (Source: Malwarebytes)<\/p>\n

On Friday, February 4, the ransomware group claimed<\/a> the ransom had been paid, with Reuters quoting the attackers <\/a>as saying the money was paid by a “very rich unknown philanthropist”. Both ION and LockBit declined to reveal further details.<\/p>\n

In an interview<\/a> with The Register, Tom Kellermann, senior VP of cyber strategy at Contrast said that supply chain attacks like this are becoming common in the financial sector. “Shared service providers are being increasingly targeted by cybercrime cartels to manifest island hopping,” he said. “Cyberattacks in the financial sector are no longer merely about conducting a heist but rather to hijack the digital transformation of the victim so as to launch attacks against their customer base.”<\/p>\n

Last month, the LockBit ransomware group attacked Royal Mail<\/a> during the first week and the Housing Authority of the City of Los Angeles (HACLA)<\/a> just days after.<\/p>\n

\"Stop<\/a><\/p>\n

How to avoid ransomware<\/h2>\n

There is no doubt hospitals remain under a bullseye, and attackers can strike at any time. Thankfully, there are ways organizations can help reduce their risk of suffering from a ransomware attack.<\/p>\n