Indian pharma giant Granules India says ransomware attack significantly affected production runs

Granules India, one of India’s largest pharmaceutical companies, said it suffered a major cyber security incident that affected daily operations at its facilities and significantly impacted its profitability.

Hyderabad, India-based pharmaceutical manufacturing company Granules India is a leading manufacturer of off-patent drugs such as Paracetamol, Ibuprofen, Metformin, and Guaifenesin. The company mass produces Paracetamol API and until 2019, ran an Ibuprofen API manufacturing facility in Wuhan, China in a joint venture with Chinese pharmaceuticals company Hubei Biocause Heilen Pharmaceutical.

The pharmaceuticals manufacturer announced in a filing with the National Stock Exchange of India on 25th May that it recently identified a cyber security incident affecting its internal network and took steps to isolate all impacted systems.

“The Company is investigating the matter with utmost priority. The appropriate containment and remediation actions are being taken in a controlled manner to address the incident,” the filing reads.

In another regulatory filing on 29th June, Granules India said that a ransomware group has claimed responsibility for the cyber attack on the company. While Granules India did not name the ransomware group, it said that the company has taken “enhanced security measures” to handle the situation and “reduce the likelihood of a similar occurrence in the future.”

“The Company has acted decisively to control and address the impact of the IT security incident employing the appropriate incident response protocols for containment and to minimize the risk.

“Additional measures are being taken to ensure the integrity of its systems infrastructure and data. Expert guidance from global cyber security specialists is currently being followed in carrying out these measures,” the company added.

Granules India also said that it has isolated the affected systems and initiated a recovery and restoration process. “This had a major effect on the operations of our business due to significant changes in our IT systems and the time needed for meeting the regulatory expectations, qualifications, recertifications, and fine-tuning of quality and production systems,” said Chaitanya Tummala, the company’s Secretary and Compliance Officer.

Granules India added that its clients should expect delays in the clearance of material as there are backlogs that the company is trying to clear and is expecting a significant loss of revenue and profitability due to this cyber security incident.