Baloise Group
Incident posture
Linked entities
- Victim
- Baloise Group
- Threat actors
- 0 actors
- Sources
- 1 source
Timeline
Summary
A cyberattack targeted parts of the Baloise Group's IT infrastructure, prompting rapid containment measures including isolating compromised systems. This caused temporary disruptions in certain distribution channels and potential service limitations, though no evidence of corporate or customer data theft was found and further system isolations were deemed unnecessary based on initial assessments.
Motives
Detailed motive labels are available to members.
TTPs
Detailed technique labels are available to members.
Description
On April 11, 2022, Baloise Group detected a cyberattack targeting portions of its IT infrastructure. The organization initiated immediate countermeasures to repel the intrusion, focusing on identifying and isolating compromised systems. This containment strategy caused temporary operational limitations within the tied sales operations of Basler Deutschland, a subsidiary operating in Germany. Baloise acknowledged the incident could lead to additional short-term service disruptions across broader customer interactions as security protocols remained active. The company stated no evidence suggested further system isolations would be necessary beyond initial containment actions. Throughout its response, Baloise maintained no corporate or customer data had been exfiltrated based on preliminary forensic assessments.
The incident response prioritized containment through system isolation while minimizing operational downtime where possible. Baloise publicly apologized for inconveniences caused to customers and partners, committing to transparent updates as new information became available. Service disruptions remained confined to specific operational segments, primarily impacting sales channels reliant on affected infrastructure. No prolonged data breach or system-wide compromise was reported following the containment phase. Baloise reiterated its commitment to protecting customer and partner data through ongoing security enhancements without disclosing specific technical remediation steps. The company concluded its initial statement by emphasizing continued vigilance against future attacks while restoring normal operations.
Sources
Sources available to members: 1 source.