AEP GmbH

Summary

AEP GmbH experienced a targeted criminal cyber attack involving partial encryption of its IT systems through specialized software. The organization promptly enacted protective measures, including disconnecting external connections, shutting down affected systems, and collaborating with external cybersecurity and forensic experts to investigate the incident and develop solutions. Operational disruptions ensued, severely limiting phone availability and restricting email communications. The company is actively assessing the attack's scope while maintaining daily customer updates on recovery progress.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

AEP GmbH experienced a criminal cyber attack detected on October 28, 2024, resulting in partial encryption of IT systems through specialized malware. The organization's security systems identified the intrusion, prompting immediate protective measures including disconnection of all external network connections and shutdown of compromised infrastructure. External cybersecurity and digital forensics experts were engaged to assist with containment and analysis efforts. Operational disruptions ensued, significantly limiting phone communications and reducing email accessibility to minimal capacity. The company prioritized isolating affected systems to prevent further propagation of the encryption mechanism across the network.

Investigations remain ongoing to determine the full scope of compromised infrastructure and data impact. AEP maintains daily customer communications regarding incident developments through alternative channels while primary contact methods remain impaired. Internal and external technical teams continue forensic examinations to establish attack vectors, dwell time, and potential data exfiltration. No restoration timeline or specific attribution details have been disclosed publicly. Business continuity measures focus on maintaining critical operations through manual processes where feasible during system outages. The organization has not released information regarding ransom demands, payment status, or data recovery methodologies at this stage.

Sources

Sources available to members: 1 source.