EquiLend Cyberattack: Lessons on Vendor Dependence

Updated October 2026. First published January 2024.

On January 22, 2024, EquiLend found what it first called a technical issue that had taken parts of its system offline. EquiLend runs NGT (Next Generation Trading), an electronic trading platform for securities lending, and Reuters reported that the outage hit some automated securities lending services. Two days later, EquiLend told clients it had found "a cyber security incident involving unauthorized access to our systems," and that restoring service "may take several days."

It took about two weeks. EquiLend said all client-facing services were available again on February 5. In March, it told employees that the attackers had taken payroll and HR data, including names, dates of birth, and Social Security numbers, and it reported the breach to Massachusetts regulators. It said it had found no evidence that client transaction data was accessed or taken (SecurityWeek). LockBitSupp, the LockBit ransomware group's public face, claimed the attack in a statement to Bloomberg. EquiLend didn't confirm it. Our post on LockBit and Operation Cronos covers the group.

Our original post used the attack as a reason to talk about cybersecurity in general. The more useful question for an operations desk is narrower: what happens to your business when a platform you depend on is gone for two weeks?

What the Market Did

FS-ISAC, the financial sector's information-sharing group, put out a short statement on January 29: "As needed, market participants have adjusted by moving to existing manual processes, with limited impact observed."

The word that matters there is "existing." In practice, going manual took a process that still worked, people who knew how to run it, and counterparties who would accept it. Once service came back, anything booked by hand had to be matched against what the platform showed. If your firm had retired its manual process years earlier, it had to invent one in the middle of the outage.

What the Rules Already Ask

None of this needs a new rule. Two existing ones cover it.

FINRA Rule 4370 requires a written business continuity plan that addresses, at a minimum, "critical business constituent, bank, and counter-party impact," along with mission critical systems and regulatory reporting. A securities lending platform is a critical business constituent for a lending desk. The rule also requires an annual review of the plan.

FINRA's Regulatory Notice 21-29 on vendor management asks whether firms have "contingency plans for interruptions or terminations of Vendor services," and suggests contracts address notice to the firm of cybersecurity events and the vendor's efforts to fix them.

A Plan for the Platform You Can't Lose

For each platform your desk can't trade, settle, or report without, write down five things:

What stops when it goes down, and how quickly that starts to cost money or miss a deadline.
The manual path: how trades get agreed, booked, and confirmed without it, and which counterparties have agreed to work that way.
Who can run the manual path today, by name. If that's one person, it's a gap.
How you'll reconcile what was booked by hand against the platform's records once it's back, and who signs off.
What the contract says about telling you, how fast, and what the vendor owes you when it's down.

Then run it. A tabletop exercise where the platform is unavailable for ten business days, about as long as EquiLend's outage, will show you more than a review of the plan on paper, and it fits inside the annual review that Rule 4370 already requires.

Due diligence comes before all of this, and the security report your vendor sends is part of it. Our post on reading a vendor's SOC 2 Type II report covers what to check in one. A clean report still won't tell you what your desk does on day three of an outage.