Cyber Incident Victim: Delfingen
Date:
Jul 2025
Location:
France
Summary
A cybersecurity intrusion at Delfingen resulted in data leaks affecting legacy applications acquired from Schlemmer, which were undergoing decommissioning without disrupting ongoing operations. The company mobilized internal teams and external experts to implement protective measures and mitigate potential impacts while maintaining communication with relevant stakeholders and authorities.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On July 16, 2025, Delfingen Group publicly disclosed a cybersecurity incident involving unauthorized access to its information systems. The intrusion resulted in confirmed data leaks from legacy applications inherited from Schlemmer, a company whose systems were undergoing active decommissioning at the time of detection. Forensic analysis revealed the breach was confined to these specific legacy applications, which were isolated from core operational infrastructure. This containment prevented disruption to ongoing business activities across Delfingen's global automotive, robotics, and energy sector operations. Internal security teams identified the intrusion through unspecified detection mechanisms and immediately initiated incident response protocols.
Delfingen mobilized its internal cybersecurity personnel alongside external experts to implement enhanced protective measures across affected systems. The organization maintained continuous communication with relevant stakeholders, including regulatory authorities, while conducting impact assessments. As a multinational entity with 3,800 employees across 41 locations in 21 countries, Delfingen prioritized maintaining operational continuity during remediation. No evidence suggested expansion beyond the legacy Schlemmer applications or compromise of Euronext Growth Paris trading systems. The company's established infrastructure in Europe, Africa, Asia, and the Americas remained fully operational throughout the incident lifecycle. Response efforts focused on securing vulnerable entry points and accelerating the planned deinstallation of compromised legacy systems.