Cyber Incident Victim: Syma-SYSTEM GmbH
Date:
Mar 2025
Location:
Austria
Summary
Syma-SYSTEM GmbH reported a cyberattack that affected its Austrian subsidiary, with the ransomware group Play claiming responsibility and threatening to leak stolen data. The firm said it restored operations with help from its IT provider and security experts, informed customers, and is cooperating with Austrian and Swiss authorities while having notified regulators under GDPR.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On March 1, 2025, the trade fair construction and system technology specialist Syma-SYSTEM GmbH, headquartered in Kirchberg (SG), reported that its Austrian subsidiary had become the target of a cyber attack. The attack was confined to the Austrian site according to the company's current assessment. The ransomware group Play claimed responsibility for the incident on the dark web and threatened to publish data that had been exfiltrated. Syma informed its customers about the breach.
With assistance from the Syma group's IT service provider and additional security experts, the operational environment for Syma Austria was restored largely and quickly, allowing the company to resume regular business operations. The incident was reported to the relevant supervisory authorities in accordance with the GDPR. Syma-System and its parent company Syma Holding announced that they would cooperate with the Austrian and Swiss police authorities in the ongoing investigation. No further details about the specific systems affected or the volume of data compromised were disclosed in the public statement.
The Syma press office stated that, because the investigation was still underway, no additional information could be provided at that time. The company emphasized that it was working closely with the competent authorities and doing everything possible to assess the situation carefully. The statement concluded that Syma would continue to monitor the developments and take any necessary steps as the investigation progresses. This marks the end of the publicly available account of the cyber attack on Syma's Austrian operations.