Cybercrime: Schmersal Group Operational Again Following Cyber Attack
June 23, 2020
The call came at 4.45 pm on 20 May – the Schmersal Group was officially informed that cyber criminals were planning to launch a targeted attack on the company’s network. The call was verified (it could have been a fake) and it was then down to the IT managers to think fast and take action. Their decision was ultimately to shut down the entire network – a hugely significant action. The connection to the internet was terminated within ten minutes, and within 90 minutes, the entire IT network worldwide was offline. Everything had been disconnected, from the telephone system to the entire ERP system infrastructure, as well as the entire production process and fully automated storage, at all locations.
As it turned out, this was the only right decision, and it was implemented at exactly the right time. IT forensic experts were then able to identify the highly aggressive malware and isolate it. It was obvious that the attacker was still in the preparatory phase of the attack when the systems were shut down, and it was important to stop the attacker from completing the attack. As such, it was essential that the systems remained offline as a precaution, until they could be completely cleansed. The offline status remained in place for several days thereafter, with production at a standstill, while the administration and sales departments worked tirelessly to inform customers, suppliers and other business partners of the ongoing situation. Philip Schmersal, Managing Director, explains, ‘Situations like these really highlight how dependent companies now are on IT. Making telephone calls, e-mails, accepting orders – we had to find alternative channels for every process. We worked extremely hard to keep in contact with our customers in every conceivable way and to keep them up to date. Ultimately, it was important to minimise the impact on our customers’ supply chains. At the same time, we had a lot of “manual work” to do. As the Schmersal-specific malware was not recognised by any of the standard virus scanners at first, each computer needed to undergo an individual cleansing routine. In parallel to that, communication was maintained using replacement servers, and thousands of e-mails of orders were printed out and processed manually, and software programs booted up again.’
After a week of extremely intense work, the ERP system was up and running again and the central warehouse in Wuppertal could function again. The global communications network between the seven production sites and 64 national companies and sales representations was also successfully reactivated. It took a further week for production at the German sites to be fully restored. On the lessons learned from the incident that brought the company to a fortnightly standstill, Philip Schmersal says, ‘Firstly, we were fortunate to be warned so that we could act quickly. I was extremely impressed by the commitment of our staff who worked to maintain emergency operation without the network being available and did so completely independently of working times and departmental affiliation, even working at weekends. This crisis really showed that we live up to our corporate philosophy – we operate as one company. Staff put this into practice with fantastic commitment, thereby helping to ensure that we could get everything up and running again quickly, considering the severity of the attack.’
The responsible managers were also impressed by the close cooperation with neighbouring companies and network partners in the region. Philip Schmersal continues, ‘It was only with help from local medium-sized enterprises that we were able to complete the extensive work needed on the IT infrastructure. We’d also like to express our gratitude to a number of other companies in the automation sector that have already fallen victim to such attacks and selflessly assisted us over those fourteen days. We must also thank our customers for their patience and understanding, and in particular, our staff, for their extraordinary commitment during this difficult period.’
The attack demonstrated that standard protection from antivirus programs and a firewall is powerless in the event of a targeted attack with previously unknown malware. Schmersal has handed comprehensive information on the malware to relevant providers of antivirus programs. Providers have since acted to strengthen their protection so that, to the fullest extent possible, this particular virus can no longer inflict damage. Philip Schmersal continues, ‘Nevertheless, we have learned that company IT in medium-sized enterprises needs to redefine itself and that the topic of security really is a top priority.’
