Fareva Group

Summary

A French pharmaceutical firm involved in packaging COVID-19 vaccines experienced a cyberattack that disrupted operations, halting production and forcing employees into indefinite unemployment leave. The incident occurred amid heightened concerns following a separate cyberattack on the European Medicines Agency, which compromised documents submitted by Pfizer for vaccine authorization. While the company did not confirm ransomware involvement, the attack impacted critical vaccine packaging activities for CureVac's COVID-19 vaccine candidate alongside other pharmaceutical products like Viagra. Management remained silent on operational specifics despite the evident production standstill.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In December 2020, the Fareva Group, a Luxembourg-headquartered pharmaceutical manufacturer involved in packaging medications including Viagra and CureVac's COVID-19 vaccine candidate, suffered a cyberattack. The incident occurred amid heightened cybersecurity concerns following the European Medicines Agency's December 9 disclosure of its own cyberattack, which compromised COVID-19 vaccine-related documents submitted by Pfizer. Fareva's attack was publicly revealed approximately one week after the EMA breach, with local media reports indicating the attack caused complete production stoppages across affected facilities. Management implemented indefinite unemployment leave for employees as operations halted, though the company declined to officially confirm or deny whether ransomware was involved in the disruption. The timing coincided with Fareva's critical preparations for COVID-19 vaccine packaging work, creating potential implications for pandemic response efforts given their contract with German biotechnology company CureVac.

The cyberattack's operational impacts were severe enough to halt all manufacturing activities indefinitely, though Fareva's management maintained limited public communication about the incident's nature or scope. No technical details regarding attack vectors, data compromise, or threat actors were disclosed by the company or corroborated in available reports. The production freeze affected both standard pharmaceutical packaging operations and COVID-19 vaccine preparation work, though the specific duration of disruptions remained unclear from available information. Employee furloughs suggested prolonged recovery expectations, but the company provided no restoration timeline or mitigation details. Media reports indicated management refused to address ransomware speculation despite the attack's characteristics aligning with contemporaneous ransomware operations targeting healthcare entities during the pandemic.

Sources

Sources available to members: 1 source.