[BreachExchange] Packaging Giant WestRock Says Ransomware Attack Hit Production

[Destry Winant]

https://www.securityweek.com/packaging-giant-westrock-says-ransomware-attack-hit-production

Atlanta-based packaging giant WestRock (NYSE: WRK) on Friday shared an
update on the recent ransomware incident that impacted the company’s
information technology (IT) and operational technology (OT) systems.

The company has been investigating the incident while working on
restoring impacted systems. The response process has involved
proactively shutting down certain systems and enhancing cybersecurity
measures.

The incident has impacted production, but WestRock says its operations
are nearly back to normal. Some tasks are being performed manually by
staff until all systems are restored.

“The Company’s mill system production through February 4 was
approximately 85,000 tons lower than plan,” the company said in a
press release on Friday.

To put that in perspective, WestRock’s annual report for 2020 says its
corrugated packaging mills had an annual production capacity of nearly
12 million tons, while its consumer packaging mills had a production
capacity of nearly 4 million tons.

The company has not shared any information about the attack itself and
the ransomware that was used.

WestRock said it continues to assess the overall operational and
financial impact of the incident, but noted that it does have cyber
insurance.

“The Company maintains a variety of insurance policies, including
cyber insurance and business interruption insurance. There may be a
time lag between the initial incurrence of costs and the receipt of
any insurance proceeds as the Company’s operations return to normal,”
WestRock said.

The company’s stock fell by roughly 4 percent after news of the breach
broke, and it has yet to recover.

This was not the only recently disclosed ransomware attack that had an
impact on not only IT systems, but also OT systems. Trucking giant
Forward Air, which suffered a ransomware attack that hit OT and IT
systems in December 2020, estimated this week that the incident would
have an impact of $7.5 million.