Häfele cyber incident: current status and further procedure

Dear Häfele Partner,


in the night of 02.02.23 there was a ransomware attack on the IT systems of the Häfele Group from an external source. The preventive shutdown of our system landscape is now being followed by a gradual and controlled reconstruction.

We immediately notified the state authorities about the attack. The Calw criminal investigation department is leading the investigation in close cooperation with us and our external forensic experts.

As a customer, you can currently reach your contact person on their cell phone. In the next step, we will restore nationwide accessibility. We currently expect this to be achieved by the end of this week.

Even after further intensive analysis, there are currently no indications of an outflow of customer data. As a highly precautionary measure, we have notified the data protection authority.

The following applies to all customers and / or suppliers who have an interface (VPN, FTP, EDI, B2B, API, VMI) to Häfele: We have disconnected all connections after the incident. Please do not connect via the interface at this time. We are working hard to find a secure solution and will inform you as soon as the interface is available again and will then provide you with the new access data.

We are making noticeable progress in the reconstruction of our merchandise management system and can access the necessary data. We are not yet able to give a binding date for the complete restoration.

We will keep you informed about the further progress and apologize for any inconvenience.

Gregor Riekena (Chairman of the Executive Board)
Nikolas Bransch (Sales Manager Germany)