Ransomware Attack Hits Global Sewing Giant SVP Worldwide

Incident Date:

November 2, 2024

World map

Overview

Title

Ransomware Attack Hits Global Sewing Giant SVP Worldwide

Victim

SVP Worldwide

Attacker

Black Suit

Location

Jönköping, Sweden

, Sweden

First Reported

November 2, 2024

Ransomware Attack on SVP Worldwide by BlackSuit Group

SVP Worldwide, the largest consumer sewing machine company globally, has fallen victim to a ransomware attack by the notorious BlackSuit group. Known for its iconic brands SINGER®, HUSQVARNA VIKING®, and PFAFF®, SVP Worldwide operates in over 190 countries, with a significant presence in the manufacturing sector. The company, headquartered near Nashville, Tennessee, has a rich history dating back to 1851 and is renowned for its innovative sewing technology.

Company Profile and Industry Standing

SVP Worldwide stands out in the sewing machine industry due to its extensive product range and market dominance, accounting for approximately one out of every three household sewing machines sold globally. The company employs around 604 individuals and reported an annual revenue of $326.2 million. Its commitment to innovation is evident in its development of advanced sewing technologies, including the cloud-based mySewnet® operating system.

Attack Overview

The BlackSuit ransomware group has claimed responsibility for the attack on SVP Worldwide, alleging that their attempts to negotiate with the company's management were ignored. The group has criticized SVP Worldwide for prioritizing financial considerations over the security of personal data belonging to employees and partners. This breach highlights the vulnerabilities that large manufacturing companies face, particularly those with extensive global operations and digital infrastructures.

BlackSuit Ransomware Group

BlackSuit, a successor to the Royal ransomware family, is known for its double extortion tactics, where they exfiltrate sensitive data before encrypting it. The group has been active since early 2023 and has targeted various high-profile organizations, including those in the healthcare and media sectors. BlackSuit typically gains initial access through phishing emails, disabling antivirus software, and exfiltrating data before deploying ransomware.

Potential Vulnerabilities

SVP Worldwide's extensive global operations and reliance on digital systems for manufacturing and distribution may have made it an attractive target for BlackSuit. The company's significant digital footprint, including its R&D centers and software development hubs, could have provided multiple entry points for the ransomware group. The attack underscores the importance of effective cybersecurity measures in protecting sensitive data and maintaining operational integrity.

Sources

Recent Ransomware Attacks

The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.

The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.