Defense contractor Hensoldt confirms Lorenz ransomware attack

Hensoldt, a multinational defense contractor headquartered in Germany, has confirmed that some of its UK subsidiary’s systems were compromised in a ransomware attack.

The defense multinational develops sensor solutions for defense, aerospace, and security applications, is listed on the Frankfurt Stock Exchange, and had a turnover of 1.2 billion euros in 2020.

It operates in the US under a special agreement that allows it to apply for classified and sensitive US government contracts. 

Its products include radar arrays, avionics, and laser rangefinders used on M1 Abrams tanks, various helicopter platforms, and LCS (Littoral Combat Ship) by the US Army, US Marine Corps, and the US National Guard.

Hensoldt announced on Thursday that it’s equipping German-Norwegian U212 CD submarines built by the kta consortium with next-generation fully digital optronics equipment.

While the company is yet to issue a public statement regarding this incident, the Lorenz ransomware gang has already claimed the attack.

On Wednesday, a Hensholdt spokesperson confirmed Lorenz’s claims after BleepingComputer reached out over email.

“I can confirm that a small number of mobile devices in our UK subsidiary has been affected,” Hensoldt’s Head of Public Relations, Lothar Belz, told BleepingComputer.

However, Belz denied providing additional information regarding the incident, saying that “for obvious reasons, we do not disclose any more details in such cases.”

Ransomware gang says they were paid

For its part, the Lorenz ransomware group claims to have stolen an undisclosed amount of files from Hensholdt’s network during the attack.

The gang has published 95% of all stolen files published on the ransomware’s data leak website in the form of password-protected archives since December 17, 2021, when the Hensoldt leak page was first created.

Lorenz began operating in April 2021 and has since been targeting enterprise organizations worldwide, demanding hundreds of thousands of dollars in ransoms from each of their victims.

This ransomware gang is also known for selling stolen data to other threat actors to pressure victims into paying ransoms.

If no ransom is paid after all data is leaked as password-protected RAR archives, Lorenz will also release the password to access the data leak archives to make the stolen files publicly available to anyone who downloads leaked archives.

This ransomware gang will also sell access to the victims’ internal networks to other threat actors along with any stolen data.

In June, Dutch cybersecurity firm Tesorion released a free Lorenz ransomware decryptor, which victims can use to recover some file types, including Office documents, PDF files, images, and videos.

Update: Removed mention of a payment linked to Hensoldt leak.