Crown Equipment confirms a cyberattack disrupted manufacturing

Forklift manufacturer Crown Equipment confirmed today that it suffered a cyberattack earlier this month that disrupted manufacturing at its plants.

Crown is one of the largest forklift manufacturers in the world, employing 19,600 people and having 24 manufacturing plants in 14 locations worldwide. 

Since approximately June 8th, Crown employees have been reporting that the company was breached and all IT systems were shut down, with employees told not to accept MFA requests and to be wary of phishing emails.

With IT systems down, employees have been unable to clock in their hours, access service manuals, and, we are told, deliver machinery in some cases.

In an email sent to employees yesterday and seen by BleepingComputer, Crown finally confirmed that they suffered a cyberattack by an "international cybercriminal organization".

A portion of this email is shared below:

As first reported by BornCity, it is believed that the breach occurred after an employee fell for a social engineering attack and allowed a threat actor to install remote access software on their computer.

Employees told BleepingComputer that the most frustrating part of this incident had been the lack of transparency and communication they received from the company.

Employees were originally told they would need to file for unemployment or use their banked paid time off (PTO) and vacation days if they still wanted to get paid for the missed days.

However, BleepingComputer was told that this changed and employees would receive their regular pay as an advance, with the ability to make up for the lost hours.

Today, Crown publicly confirmed the cyberattack for the first time, stating that its ongoing security measures played a role in limiting the effects of the attack.

"The company is still working through the disruption caused by the attack and is making progress toward transitioning to normal business operations. Crown is also working closely with its customers to help reduce the effect the incident may have on their operations," reads a statement shared with BleepingComputer.

The company is now slowly bringing systems back online, though manufacturing remains disrupted.

While Crown has not shared what type of cyberattack they suffered, they did state it was caused by an "international cybercriminal organization," which means the company likely suffered a ransomware attack.

Unfortunately, if it was ransomware, it also means that corporate data was likely stolen in the attack and will be leaked if a ransom is not paid.

BleepingComputer asked Crown if ransomware was behind the attack, but they said no additional information was available besides what is in today's statement.