Ransomware attack halted book printer CPI UK's production for weeks

CPI, a pan-European book manufacturer and the largest supplier of printed books in the United Kingdom, had its IT systems disabled by a cyberattack in the early hours of Friday 7 February 2025. The company said the incident affected the UK part of its business, which prints from a group of sites across the country. Trade coverage described the incident as a ransomware attack.

CPI told customers that it had brought in external technical specialists to investigate and restore its systems, and that it expected to resume full services gradually over the following days. CPI operates nine UK factories, and reporting on the incident said production stopped at eight of them for more than twelve days.

Publishers absorbed the disruption through delayed print runs. The Bookseller reported that CPI clients including the Welsh independent Firefly Press were significantly affected, with March reprints pushed back. Firefly's Penny Thomas said she went to other printers and they either could not fit the work in or were not as price competitive, and that having to print digitally elsewhere would wipe out some of the profit on some print runs. Some customers reported delays of around eighteen days after the attack.

CPI did not publicly identify the attackers or say whether any data had been taken. The Bookseller reported that London agency The Agency had been hit by the Rhysida group in the same period, while noting there was no indication the same operation was responsible for the CPI attack. As of late February 2025 CPI had issued no further public statement on data exposure.