Trade secrets stolen from steel maker ThyssenKrupp in cyber attack
Image credit: Reuters
German steel giant ThyssenKrupp has admitted that it had trade secrets stolen by hackers in a cyber attack earlier this year.
ThyssenKrupp’s IT experts first spotted signs of the large-scale breach in the systems for its steel production and manufacturing plant design divisions in April. The attack is believed to have started two months prior to that discovery.
The company delayed revealing the information while it investigated the breach and implemented new defences. Data from multiple divisions including engineering were stolen by what ThyssenKrupp described as highly organised and professional attackers based in southeast Asia.
“It is important not to let the intruder know that he has been discovered,” ThyssenKrupp’s spokesman said on Thursday, explaining the delayed disclosure.
Secured systems operating steel blast furnaces and power plants in Duisburg, in Germany's industrial heartland in the Ruhr Valley, were unaffected, the company said.
No breaches were found at its marine systems unit, which produces military submarines and warships.
A criminal complaint was filed with police in the state of North Rhine-Westphalia and an investigation is ongoing, the company said. State and federal cyber-security and data protection authorities were kept informed at each stage, as well as Thyssen's board.
According to German business magazine Wirtschafts Woche, the attack affected ThyssenKrupp's sites in Europe, India, Argentina and the USA. The Hagen Hohenlimburg speciality steel mill in western Germany was also targeted, the report added.
The company, however, declined to identify specific locations which were infected and said it could not estimate the scale of the intellectual property losses.
Businesses can lose billions from industrial cyber espionage. However, these incidents are reported much less frequently than cyber attacks on banks, retailers and other services that involve theft of user data and direct financial losses.
A previous cyber-attack caused physical damage to an unidentified German steel plant and prevented the mill's blast furnace from shutting down properly.
The country's Federal Office for Information Security (BSI) revealed two years ago that the attack caused massive damage, but gave no further technical details and the location of the plant has never been revealed.
ThyssenKrupp's disclosure followed last week's attack on Deutsche Telekom routers that caused outage for nearly one million customers.
The industrial conglomerate, along with Airbus parent EADS, were the targets of major attacks by Chinese hackers in 2012, according to a Der Spiegel report.
Despite its rising prominence and the significance of the financial losses it can lead to, the danger of cyber-crime is still frequently underestimated.
In a recent survey by BT, 60 per cent of respondents said they fear being a victim of a physical robbery or break-in much more than being a victim of cyber crime. Figures suggest the two are equally likely to happen.
“The Crime Survey of England and Wales showed that people are much more likely to be a victim of digital crimes in the UK, with almost half of all crime now either fraud or cyber crime,” said Commander Chris Greany from City of London Police.
“Just as people protect their home from burglary, so they also need to protect their digital presence. Many broadband and telephone providers now offer free security solutions and we strongly encourage everyone to take advantage of these to ensure they are protected against the less visible dangers online and over the phone.”