German manufacturer says malware has caused ‘significant disruption’ to plants in three countries

Parent company Rheinmetall Group said it expects to lose 3 to 4 million euros per week, starting next week.

A malware infection at German car parts manufacturer Rheinmetall Automotive has caused “significant disruption” to production at company plants in Brazil, Mexico, and the United States, the company disclosed Thursday.

Rheinmetall Group, the manufacturer’s parent company, said it expects to lose 3 to 4 million euros, or $3.28 to $4.38 million, per week due to the incident, starting next week. Rheinmetall Automotive provides top car manufacturers with auto parts such as pistons, engine blocks, and emissions control equipment, according to its website. Rheinmetall Group’s IT systems outside of plants in those three countries do not appear to be affected, the company said.

Since late Tuesday, Rheinmetall Automotive said in a statement, it has been grappling with “malware attacks” and the “length of the disruption cannot be predicted at this time. The most likely scenarios suggest a period lasting between two and four weeks.”

Shares in the company dropped early Friday on the heels of the incident.

A spokesperson for Rheinmetall Automotive could not be reached for comment on the type of malware deployed and who the suspected attacker was.

Manufacturers have in some cases opened up more avenues for hackers by embracing digitization in recent years, observers say. The sector is also saddled with legacy devices that aren’t properly secured, according to David Wolf, principal security researcher at cybersecurity company Forescout.

Among the sectors the Forescout tracks, Wolf  said, “manufacturing has a significant ratio of unmanaged Windows devices, and the highest ratio of unknown, unclassified devices, partly because manufacturing firms use a lot of legacy, embedded technology that’s sensitive to active inspection.”

One of the most impactful recent cybersecurity incidents in the manufacturing sector occurred at Norsk Hydro, a top aluminum producer. In March, Norsk Hydro was hit with malware that forced the company to temporarily stop some production and switch to manual operations in some areas.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure