Rheinmetall cyberattack hit civilian division, defence business unaffected

Rheinmetall, the German group that manufactures both automotive components and military equipment, confirmed on 14 April 2023 that it had been hit by a cyberattack. Reuters reported the same day that the intrusion affected the business unit serving industrial customers, primarily in the automotive sector.

The company said its defence business was not affected, pointing to strictly separated IT infrastructure between the civilian and military sides of the group. That division supplies ammunition and vehicle components, including parts for Leopard tanks used by Ukrainian forces, and Rheinmetall said it continued to operate reliably.

A company spokesperson said Rheinmetall was investigating the extent of the damage and was in close contact with the relevant cybersecurity authorities. Prosecutors in Cologne confirmed they had opened an investigation but gave no further detail, and Rheinmetall filed a criminal complaint over the incident.

The attackers were unidentified at the time of reporting. The Russian aligned hacktivist group Killnet had earlier urged followers to launch denial of service attacks against Rheinmetall, and the company acknowledged seeing elevated network traffic but said it had not affected its IT infrastructure. In May 2023 Rheinmetall confirmed that the Black Basta ransomware group was behind the April intrusion. The company did not publicly detail what data, if any, was taken.