Keytronic confirms data theft after Black Basta ransomware attack

Keytronic, the Spokane-based contract electronics manufacturer formally named Key Tronic Corporation, confirmed in June 2024 that attackers had stolen personal data during a ransomware attack detected on 6 May 2024.

In filings with the US Securities and Exchange Commission the company said it had found unauthorised third-party access to portions of its IT systems and had activated its cyber incident procedure, engaging outside cybersecurity experts and notifying law enforcement. The intrusion limited access to business applications supporting operations and corporate functions, including financial and operating reporting systems.

Keytronic suspended manufacturing in the United States and Mexico for roughly two weeks as a precaution, while operations elsewhere continued. The company said normal production had since resumed and corporate functions were restored, but warned that the disruption and recovery costs would materially affect results for the quarter ending 29 June 2024. It put expenses for external consultants at about $600,000 at that stage.

The Black Basta ransomware group claimed responsibility and published what it said was the complete haul, described by SecurityWeek as more than 500 gigabytes and by Security Affairs as roughly 530GB. The gang said the files covered human resources, finance, engineering and corporate data, and shared screenshots of employee passports and Social Security cards. Keytronic characterised the exfiltrated data as limited but confirmed it included personally identifiable information, and said it was notifying affected parties and regulators.