Baccarat S.A.

Summary

The French crystal manufacturer Baccarat, a 257-year-old Paris-based company, disclosed it was targeted in a cyberattack via an email from CEO Maggie Henriquez sent to customers. The company stated that a portion of its activity was constrained as a result, though there is no evidence at this stage that any personal or confidential customer data was compromised. As a precaution, Baccarat urged customers to remain vigilant against suspicious messages or unusual requests purportedly from the company and to verify any questionable communications by phone. The attack impacted the crystal brand's operations but did not affect the separately operated Baccarat Hotel in New York, according to a hotel spokesperson. The nature of the cyberattack has not been publicly specified.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Baccarat S.A., the 257-year-old French crystal manufacturer based in Meurthe-et-Moselle, experienced a cyberattack that came to public attention in early September 2023. The disclosure was made by the company's Chief Executive Officer, Maggie Henriquez, who was appointed to lead the company in 2021. On Tuesday, August 29, 2023, at approximately 4:16 p.m., Henriquez sent an email directly to customers alerting them to the ongoing incident. The communication was framed as a precautionary measure motivated by anticipation of risk and the prevention of potential further harm. In the message, Henriquez informed recipients that Baccarat, referred to as "our Maison," was currently facing a cyberattack, and as a direct consequence, a portion of the company's business activity was constrained. The email did not specify the technical nature of the attack, the method of intrusion, the systems affected, the threat actor involved, or the timeline of how the compromise was discovered.

The statement issued by Henriquez also addressed the question of whether customer data had been exposed. At that point in time, the company indicated that there was no indication that any customers' personal or confidential data had been compromised. Despite this initial assessment, Baccarat urged its clientele to exercise the utmost vigilance with regard to any unusual messages they might receive purporting to come from the company. Henriquez specifically warned that if customers received an unusual request from Baccarat, they should not hesitate to contact the firm by telephone in order to verify the authenticity of the communication. This guidance was issued in anticipation that the cyberattack could potentially be used as a basis for phishing campaigns or other social engineering efforts targeting individuals associated with the Baccarat brand. The email was obtained and reported on by DailyMail.com, which published its coverage the following day.

The impact of the incident on Baccarat's operations was described in limited terms in the public communications. The CEO's email stated only that a portion of the company's activity was constrained as a result of the attack, without elaborating on which specific business functions, production lines, distribution channels, or administrative systems were affected. French regional outlet France Bleu Sud Lorraine, reporting on September 1, 2023, confirmed that part of the company's activity was reduced and noted that it was not yet known whether the disruption would have an impact on production at the crystal works in Meurthe-et-Moselle. The company's manufacturing facility, located in the Lorraine region of northeastern France, is the historic heart of the Baccarat brand. Beyond the operational constraint and the absence of confirmed data compromise, the public reporting did not provide details on the duration of the disruption, the financial cost of the incident, the number of employees affected, or the specific technical remediation steps undertaken.

A separate but related entity, the Baccarat Hotel in New York City, publicly clarified that it was not affected by the cyberattack that struck the crystal company of the same name. The luxury hotel, which opened in March 2015 and is known for its high-end accommodations including suites starting at roughly $899 per night and premium suites priced up to $18,000 per night with amenities such as a complimentary Mercedes and access to a private floor, operates under the Baccarat name but is a distinct business from the crystal manufacturer. A spokesperson for the hotel confirmed to DailyMail.com that the cyberattack had not impacted hotel operations or guest data. Despite the shared branding, including 17 custom Baccarat chandeliers and approximately 100 custom-designed works of art displayed throughout the property, the hotel's information systems and the crystal firm's systems were reported as separate in the context of this incident.

The public response from Baccarat S.A. centered on direct customer communication and a request for heightened vigilance against potential follow-on phishing attempts. The company did not, in the materials reviewed, disclose the attack vector, the identity of any threat actor, whether ransomware was involved, whether a ransom demand had been received, or the anticipated timeline for full restoration of constrained services. The Paris prosecutor's office "cyber" section had opened nearly 600 investigations into cyberattacks during 2022, according to context reported alongside the Baccarat story, reflecting a broader pattern of cyber incidents affecting French entities during that period. The Baccarat communication, issued by Henriquez and referencing the 257-year heritage of the company, framed the disclosure as an exercise in transparency driven by risk prevention rather than as a notification of confirmed large-scale data loss. As of the reporting captured in the available source material, the incident remained characterized as an ongoing cyberattack with partial operational impact, no confirmed customer data compromise, and active customer-facing warnings regarding suspicious communications.

Sources

Sources available to members: 2 sources.