Cyber Incident Victim: Rheinmetall AG
Date:
Apr 2023
Location:
Germany
Summary
Rheinmetall experienced a cyberattack targeting its civilian automotive division, prompting an investigation by the Cologne public prosecutor's office and the Cybercrime Central and Contact Point North Rhine-Westphalia. The company confirmed its military operations remained unaffected while assessing the incident's scope and collaborating with authorities, though details were withheld due to ongoing inquiries.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On April 14, 2023, Rheinmetall, a Düsseldorf-based defense and automotive supplier, publicly confirmed it had fallen victim to a cyberattack following the initiation of an investigation by the Cologne Public Prosecutor's Office. The Cybercrime North Rhine-Westphalia Central and Contact Point (ZAC NRW), established in 2016 to lead significant cybercrime cases in the region, assumed investigative responsibilities. Rheinmetall disclosed the incident occurred within its civilian business division, which primarily serves the automotive industry as a supplier. The company emphasized its military division remained unaffected by the breach. Authorities refrained from commenting on the attack’s scale or methodology due to the ongoing nature of the investigation. Rheinmetall initiated internal assessments to determine the intrusion’s scope and damage while maintaining close coordination with law enforcement agencies. No operational disruptions or data compromise specifics were disclosed at this stage.
The attack exclusively targeted Rheinmetall’s civilian automotive operations, sparing its defense-related infrastructure and contracts. The company restricted public communications regarding technical details, impact magnitude, or attacker origins, citing the active status of forensic and legal proceedings. No ransomware claims, data leaks, or financial demands were reported in available disclosures. Rheinmetall’s confirmation aligned with standard incident response protocols, prioritizing containment and evidence preservation over speculative attribution. Investigative outcomes and potential collateral effects on automotive supply chains remained undetermined as of the initial announcement. The incident marked a high-profile cybersecurity event within Germany’s industrial sector, triggering procedural scrutiny but no immediate operational or financial repercussions per accessible data.