Schneider Electric hit by another breach, ransomware gang demands $125,000 “in baguettes”

Schneider Electric, the French multinational energy management corporation, confirmed a breach after ransomware gang HellCat posted demands of $125,000 in “baguettes.”

According to posts on dark web forums dated November 2nd, HellCat ransomware claims to have stolen more than 40GB of compressed data containing “compromised critical data, including projects, issues, and plugins, along with over 400,000 rows of user data.” Allegedly, cybercriminals accessed Schneider Electric’s Atlassian Jira system.

Another threat actor under the ‘grep’ moniker publicly provoked the company over the weekend on X, detailing that Schneider Electric noticed the breach and restarted the services, but the criminals retained access.

“Schneider Electric is investigating a cybersecurity incident involving unauthorized access to one of our internal project execution tracking platforms which is hosted within an isolated environment. Our Global Incident Response team has been immediately mobilized to respond to the incident. Schneider Electric´s products and services remain unaffected,” the spokesperson for the company said.

The threat actor claimed the ransom demand would decrease by 50% if the company’s CEO publicly acknowledged the breach. Otherwise, cybercriminals threatened to disseminate the information.

This is the third major cyberattack on Schneider Electric over the past 1.5 years. The Cactus ransomware gang attacked the company in February 2024, claiming it stole 1.5TB of sensitive data. Last year, Schneider Electric confirmed it was among the victims of the Cl0p ransomware group and the MOVEit zero-day campaign.

Schneider Electric, valued at approximately $145 billion, ranks among the Fortune Global 500 companies.

Updated on November 8th [07:30 a.m. GMT] with a statement from Schneider Electric.