KISTERS reports on ransomware attack recovery and zero-payment strategy
Following a cyberattack ten months ago, KISTERS AG opted for public transparency and refused to pay a ransom, choosing instead to overhaul its entire IT infrastructure.
Approximately ten months ago, KISTERS AG was the target of a cyberattack orchestrated by the Conti ransomware group. CEO Klaus Kisters stated that the company chose to disclose the attack publicly to maintain customer trust, rather than offering vague explanations. Investigations have confirmed that no customer data has surfaced on the darknet to date.
The company declined to meet the ransom demands, which potentially reached a seven-figure sum. Kisters emphasized that paying hackers establishes a dangerous precedent, marking the organization as a repeat target. Instead, the company undertook an eight-figure recovery effort, choosing to fully rebuild systems and deploy the latest firmware and software rather than relying on potentially compromised backups for production environments.
Prior to the incident, KISTERS held ISO 27001 certification and employed dedicated security personnel. Despite these precautions, the sophisticated nature of the attack highlighted the evolving risk landscape. Following the incident, the company has further tightened security protocols to mitigate future vulnerabilities.