{
	"id": "1777f648-a8fa-4c8a-8bf5-6658d1a212d0",
	"created_at": "2026-04-06T00:09:43.208672Z",
	"updated_at": "2026-04-10T03:20:51.763606Z",
	"deleted_at": null,
	"sha1_hash": "ec3d854f9b9b25bfd8940f18d58f6b6702ee8563",
	"title": "German tech giant Software AG down after ransomware attack",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 786951,
	"plain_text": "German tech giant Software AG down after ransomware attack\r\nBy Written by Catalin Cimpanu, ContributorContributor Oct. 9, 2020 at 9:39 a.m. PT\r\nArchived: 2026-04-05 13:27:05 UTC\r\nImage: Software AG\r\nSoftware AG, one of the largest software companies in the world, has suffered a ransomware attack over the last\r\nweekend, and the company has not yet fully recovered from the incident.\r\nA ransomware gang going by the name of \"Clop\" has breached the company's internal network on Saturday,\r\nOctober 3, encrypted files, and asked for more than $20 million to provide the decryption key.\r\nEarlier today, after negotiations failed, the Clop gang published screenshots of the company's data on a website the\r\nhackers operate on the dark web (a so-called leak site).\r\nThe screenshots show employee passport and ID scans, employee emails, financial documents, and directories\r\nfrom the company's internal network.\r\nsaoftware-ag.png\r\nImage: ZDNet\r\nSoftware AG disclosed the incident on Monday when it revealed it was facing disruptions on its internal network\r\n\"due to [a] malware attack.\"\r\nThe company said that services to customers, including its cloud-based services, remained unaffected and that it\r\nwas not aware \"of any customer information being accessed by the malware attack.\" This statement was recanted\r\nin a later press release two days later, when Software AG admitted to finding evidence of data theft.\r\nhttps://www.zdnet.com/article/german-tech-giant-software-ag-down-after-ransomware-attack/\r\nPage 1 of 2\n\nThe message about the attack remained on its official website homepage all week, including today.\r\nSoftware AG did not return phone calls today for additional details or comments about the incident.\r\nA copy of the ransomware binary used against Software AG was discovered earlier this week by security\r\nresearcher MalwareHunterTeam. The $20+ million ransom demand is one of the largest ransom demands ever\r\nrequested in a ransomware attack.\r\nsoftware-ag-ransom-note.png\r\nImage: supplied\r\nThe ID provided in this ransom note allows security researchers to view the online chats between the Clop gang\r\nand Software AG on a web portal managed by the ransomware group. At the time of writing, there is no evidence\r\nthe German company paid the ransom demand.\r\nclop-software-ag-chat.jpg\r\nImage: supplied\r\nSoftware AG is Germany's second-largest company with more than 10,000 enterprise customers across 70\r\ncountries. Some of the company's most recognizable customers include Fujitsu, Telefonica, Vodafone, DHL, and\r\nAirbus.\r\nIts product line includes business infrastructure software such as database systems, enterprise service bus (ESB)\r\nframeworks, software architecture (SOA), and business process management systems (BPMS).\r\nSecurity\r\nEditorial standards\r\nSource: https://www.zdnet.com/article/german-tech-giant-software-ag-down-after-ransomware-attack/\r\nhttps://www.zdnet.com/article/german-tech-giant-software-ag-down-after-ransomware-attack/\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"references": [
		"https://www.zdnet.com/article/german-tech-giant-software-ag-down-after-ransomware-attack/"
	],
	"report_names": [
		"german-tech-giant-software-ag-down-after-ransomware-attack"
	],
	"threat_actors": [],
	"ts_created_at": 1775434183,
	"ts_updated_at": 1775791251,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/ec3d854f9b9b25bfd8940f18d58f6b6702ee8563.pdf",
		"text": "https://archive.orkl.eu/ec3d854f9b9b25bfd8940f18d58f6b6702ee8563.txt",
		"img": "https://archive.orkl.eu/ec3d854f9b9b25bfd8940f18d58f6b6702ee8563.jpg"
	}
}