Swiss multinational giant ABB hit by a Black Basta ransomware attack

Swiss multinational technology giant ABB suffered a cyber attack on May 7th that affected the company’s daily operations and forced it to take its VPN connection offline.

ABB, a Zurich-based company, develops industrial control systems (ICS) and SCADA systems for manufacturing and energy suppliers. The company works with the local government and has many notable clients including U.S. federal agencies, Volvo, Hitachi, DS Smith, the City of Nashville, the City of Zaragoza, and more.

According to BleepingComputer, the notorious Black Basta ransomware gang targeted ABB with a cyber attack on May 7 and affected its Windows Active Directory which, in turn, affected several other systems in the company’s internal network.

While the company initially chose not to comment on the security incident, it later said that it “recently detected an IT security incident that directly affected certain locations and systems.”

ABB said that as soon as it identified the security incident, it immediately disconnected its VPN connection to stop the malware from spreading. This impacted the company’s ability to continue daily operations, delayed several projects, and impacted the factories.

Acknowledging the reports of a security incident, an ABB spokesperson said, “To address the situation, ABB has taken, and continues to take, measures to contain the incident. Such containment measures have resulted in some disruptions to its operations which the company is addressing.”

“The vast majority of its systems and factories are now up and running and ABB continues to serve its customers in a secure manner. ABB continues to work diligently with its customers and partners to resolve this situation and minimize its impact,” the spokesperson added.

ABB is yet to issue a statement about the nature and scope of the cyber attack or whether it was contacted by the Black Basta ransomware group.

The Black Basta gang in March also claimed responsibility for a cyber attack on British outsourcing company Capita and leaked sensitive data allegedly stolen from the company. Information stolen by the hacker group included phone numbers, home addresses, details of more than 100 bank accounts, and sensitive personal data belonging to individuals who applied for jobs at schools.