Bassett Furniture halted manufacturing after ransomware encrypted data files

Bassett Furniture Industries, a Virginia-based furniture manufacturer and retailer founded in 1902, disclosed in a Form 8-K filed with the U.S. Securities and Exchange Commission on July 15, 2024 that it had detected unauthorized access to its information technology systems five days earlier. The company said the attacker disrupted business operations by encrypting some data files.

Bassett shut down parts of its IT environment to contain the intrusion. Because those systems supported production, the company also stopped operating its manufacturing facilities. Retail stores and the e-commerce site stayed open and customers could still place orders, but staff worked manually and the company's ability to fulfil orders was impaired. Chief executive Robert Spilman said the stores never shut down and instead operated without systems.

Business of Home reported that manufacturing was down for roughly four and a half days and had resumed by July 18, 2024. In the filing Bassett said the incident had a material impact on business operations and was reasonably likely to continue to do so until recovery efforts were complete, while noting it had not determined whether the attack would materially affect its financial condition or results.

The company said it did not believe personal information from consumers was compromised. No ransomware group publicly claimed responsibility in the period after disclosure. The attack landed in a difficult quarter for Bassett, which reported a 17 percent drop in second-quarter revenue on July 10, 2024, the same day it discovered the intrusion.