Ransomware (extortion): Production and industrial SMEs, Germany 2025
On 19 May 2025, all printers in the plant suddenly printed ransom letters; the entire IT was paralysed and production came to a standstill.
- Incident · 05.2025 · North Rhine-Westphalia (Euskirchen-Stotzheim), Germany
- Evidence: several media
- Ransomware (extortion)
As of
What happened
As early as the following day, orders worth 250'000 euros could not be fulfilled; in two weeks, around 2 million euros in revenue was lost, and the 240 employees did not receive their May wages on time. On 1 June, the long-established company filed for insolvency.
- Affected
- Fasana GmbH
- Industry
- Production and industrial SMEs
- Loss
- around EUR 2 million loss of revenue in two weeks
- Business interruption
- unknown
- Ransom demanded / paid
- yes / unknown
- Data affected
- unknown
- Bankruptcy
- yes
- Entry point
- not stated in the sources
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Loss of income after an attack
Business interruption, only after the waiting period
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Help and negotiation; only some insurers pay the ransom, see note
Mostly add-on 6 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
A two-week production standstill can drive even a medium-sized manufacturer into insolvency.
Sources
- Fasana: Serviettenhersteller nach Cyberangriff insolvent (opens in a new window) Lebensmittel Zeitung · 2025-06
- Hackerangriff zwingt Traditionsfirma in die Knie – Insolvenz folgt (opens in a new window) echo24 · 2025-06