Banks, insurers told to review cyber security

China's financial regulator told its banks and insurers to thoroughly review cyber and data security across all their businesses, underscoring the government's increased focus on national security and data integrity.

In a directive sent at the end of last year, The National Financial Regulatory Administration asked banks and insurers to fix any identified loopholes to guard against the risk of ransomware attacks by mid-January, according to people familiar with the matter.

Banks were urged to reinforce the secure usage of emails and protect against phishing, said the people, asking not to be identified discussing a private matter.

The broad directive was a follow-up on a short notice issued to its major banks after a cyberattack on Industrial & Commercial Bank of China (1398) in November crippled part of the US operations of China's largest lender and disrupted trading in the US Treasury market.

ICBC, the world's largest bank by assets, was hit by a hacker attack at a US unit in November that rendered it unable to clear trades in US Treasuries and forced it to send data around New York via thumbdrives.

Over the past decade, China has intensified its focus on national security and data flows and in 2021 Beijing enacted a sweeping data security law to ramp up control over information flows.