ICBC Settles with SEC over Ransomware Incident

​The U.S. Securities and Exchange Commission (SEC) has settled record-keeping charges with the Industrial and Commercial Bank of China (ICBC) Financial Services unit related to a ransomware attack in November 2023. The settlement addresses allegations that, following the attack, the unit failed to maintain accurate records and did not notify customers about securities transactions in a timely manner.

The SEC cited the ICBC unit's cooperation and remedial measures as factors in its decision not to impose a civil fine. The incident highlighted the importance of strong cybersecurity protocols in the financial sector.

While ICBC did not admit or deny wrongdoing, the settlement underscores the regulatory expectation for financial institutions to maintain compliance and address cybersecurity vulnerabilities transparently.