Schumag AG

Summary

A cyberattack disrupted Schumag AG's operations, forcing the cancellation of an upcoming shareholders' meeting due to logistical challenges caused by the incident. While production resumed largely unaffected shortly after the attack, the company acknowledged ongoing difficulties in assessing the full scope of damages and operational consequences. Management committed to rescheduling the critical meeting promptly but expressed regret for inconveniences to stakeholders amid the unresolved security breach aftermath.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On September 23, 2024, Schumag Aktiengesellschaft publicly disclosed it had fallen victim to a cyberattack discovered the previous day. The attack severely disrupted the company’s operations to the extent that it could no longer proceed with its scheduled Annual General Meeting (AGM), originally announced in the German Federal Gazette on August 19, 2024, and set for September 25, 2024, at 10:00 AM. This AGM cancellation represented the most immediate organizational impact, as critical systems required for conducting shareholder proceedings were compromised. The board of directors, with supervisory board approval, formally canceled the meeting and committed to rescheduling it at the earliest feasible opportunity, citing unavoidable inconvenience to shareholders. No technical details regarding the attack vector, intrusion methods, or specific compromised systems were disclosed in the initial announcement.

Despite the ongoing incident response, Schumag managed to partially restore production operations by September 23, 2024, allowing significant segments of its manufacturing activities to resume. The company emphasized its inability to quantify the full scope of operational or financial damage at that stage, noting an ongoing assessment of consequences. Schumag, a manufacturer of precision steel components and standardized parts for mold and tool engineering, serves global clients with production runs ranging from prototypes to high-volume orders. The cyberattack’s discovery prompted mandatory regulatory disclosure under EU Market Abuse Regulation (MAR) Article 17 due to its material impact on corporate operations and shareholder events. No threat actor attribution, data exfiltration claims, or ransom demands were referenced in the public statement.

Sources

Sources available to members: 1 source.