Swiss tech giant ABB says ransomware attack had minimal impact on operations

Swiss multinational technology giant ABB has acknowledged that it suffered a ransomware attack that compromised certain data but had a minimal impact on operations.

ABB suffered a significant cyber attack on May 7th that affected the company’s daily operations and forced it to take its VPN connection offline. The notorious Black Basta ransomware gang said it targeted ABB’s Windows Active Directory which, in turn, affected several other systems within the company’s internal network.

While the company initially chose not to comment on the security incident, it later said that it “detected an IT security incident that directly affected certain locations and systems.”

Acknowledging media reports of a security incident, an ABB spokesperson said, “To address the situation, ABB has taken, and continues to take, measures to contain the incident. Such containment measures have resulted in some disruptions to its operations which the company is addressing.”

“The vast majority of its systems and factories are now up and running and ABB continues to serve its customers in a secure manner. ABB continues to work diligently with its customers and partners to resolve this situation and minimize its impact,” the spokesperson added.

In a recent statement, ABB said that while its internal investigation is still ongoing, the company has determined that its internal network was infected with “ransomware that is not self-propagating” and certain data was exfiltrated during the ransomware attack.

“The company is working to identify and analyze the nature and scope of affected data and is further assessing its notification obligations. ABB will communicate with affected parties where necessary, including, for example, specific customers, suppliers, and/or individuals where personally identifiable information was affected,” the notice read.

“All of ABB’s key services and systems are up and running, all factories are operating, and the company continues to serve its customers. The company also continues to restore any remain- ing impacted services and systems and is further enhancing the security of its systems.”

In a separate notice sent to customers, ABB said that it has no evidence of any stolen data being compromised. However, the possibility of the same couldn’t be ruled out.

“While we are still analyzing the incident and are cooperating with relevant law enforcement officials, we will share additional technical information as appropriate,” ABB added.