The world’s biggest wind turbine manufacturer has said it was forced to shut down its IT systems due to a cyber attack over the weekend.
Danish firm Vestas announced that hackers managed to obtain company data as well as knock out parts of its internal IT infrastructure, which continue to be “shut down as a precaution”.
Following the attack on Friday, the company issued an update on Monday morning revealing it had “initiated a gradual and controlled reopening of all IT systems” as it continues to investigate the incident.
“There is no indication that the incident has impacted third party operations, including customer and supply chain operations,” the company stated, adding that its “manufacturing, construction and service teams have been able to continue operations, although several operational IT systems have been shut down as a precaution.”
Vestas, which operates in 80 countries across five continents, including the UK, US, Germany, Italy, the Netherlands, Taiwan, India, Australia, China, and Brazil, is the world’s biggest wind turbine manufacturer and servicer, employing approximately 25,000 people. Its partners include tech giants Lenovo and SAP, which are not thought to have been affected by the attack. IT Pro has contacted both companies for comment.
The company has not named the perpetrator of the attack, or whether the cyber attack involves ransomware.
RELATED RESOURCE
Prevent fraud and phishing attacks with DMARC
How to use domain-based message authentication, reporting, and conformance for email security
The attack follows a number of similar incidents involving US infrastructure providers including Colonial Pipeline and the Texas Power Grid, as well as UK energy giant NPower. Research conducted by cyber security firm Hornetsecurity found that the energy sector has been the leading target for cyber criminals, accounting for at least 16% of officially known attacks.
George Patterson, director of Oxford-based cyber security recruitment specialist Arrowforth, told IT Pro last month that the rise of this type of cyber attack could be attributed to the energy sector being “seen as a rather unethical industry to younger generations (most cyber hackers are young)”.
“Cynically, they know they have money and are likely to pay out to continue operations,” he added.
For example, Colonial Pipeline reportedly paid a $5 million ransom to Darkside, a Russian based cyber gang, to quickly restore fuel supplies to the US East Coast.
-
The Race Is On for Higher Ed to Adapt: Equity in Hyflex Learning -
Google faces 'first of its kind' class action for search ads overcharging in UKNews Google faces a "first of its kind" £5 billion lawsuit in the UK over accusations it has a monopoly in digital advertising that allows it to overcharge customers.
-
Cleo attack victim list grows as Hertz confirms customer data stolen – and security experts say it won't be the lastNews Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackersNews Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Healthcare systems are rife with exploits — and ransomware gangs have noticedNews Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
-
Alleged LockBit developer extradited to the USNews A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
-
February was the worst month on record for ransomware attacks – and one threat group had a field dayNews February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impactedNews The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
-
300 days under the radar: How Volt Typhoon eluded detection in the US electric grid for nearly a yearAnalysis Lengthy OT lifespans give attackers time to penetrate networks underpinning critical infrastructure and plan future disruption
-
Warning issued over prolific 'Ghost' ransomware groupNews The Ghost ransomware group is known to act fast and exploit vulnerabilities in public-facing appliances
