Thread: Garmin services go down after suspected ransomware attack

Garmin planning multi-day maintenance window to deal with ransomware incident.

Smartwatch and wearables maker Garmin has shut down several of its services on July 23 to deal with a ransomware attack that has encrypted its internal network and some production systems.
The company is currently planning a multi-day maintenance window to deal with the attack's aftermath, which includes shutting down its official website, the Garmin Connect user data-syncing service, and even some production lines in Asia.
In messages shared on its website and Twitter, Garmin said the same outage also impacted its call centers, leaving the company in the situation of being unable to answer calls, emails, and online chats sent by users.
The incident didn't go unnoticed and has caused lots of headaches for the company's customers, most of which rely on the Garmin Connect service to sync data about runs and bike rides to Garmin's servers, all of which went down on Thursday.

Image: Victor Gevers
When ZDNet reached out for comment earlier, a Garmin spokesperson declined to confirm that the outage was caused by a ransomware attack, citing an ongoing investigation, and they redirected us to a message the company had shared on its website and Twitter profile.


However, since the incident took root at around 03:00am UTC, several Garmin employees took to social media to share details about the attack, all calling it a ransomware attack.
Some Garmin employees even went as far as to attribute the incident to a new strain of ransomware that appeared earlier this year, called WastedLocker -- information that ZDNet has not been able to verify based on employee claims.
However, the incident appears to be much larger and more devastating than Garmin indicated via its initial statement.

[Only registered and activated users can see links. ]

Garmin internal employees were told that the IT server was attacked by a virus and the entire production line could not be opened. According to information security experts, this might be a ransomware attack; employees were also told that, On July 24th (Friday) and July 25th (Saturday), the production line of the Taiwan factory will stop the production line for 2 days.
The two-day internal notice of the shutdown of this production line also coincides with the announcement on Garmin's official website.
Garmin official website stated that due to system maintenance, including: Garmin customer service center (including customer service telephone and Xizhi service center) will be from 5:30 pm to 6 pm on July 23 (Thursday) (service hours on working days are from 9 am to 6 pm Point) and July 24 (Fri) ~ July 25 (Sat) will be suspended.
The announcement also includes the science and technology life experience halls in various regions of Garmin, which are temporarily unable to provide maps and software update services; other Garmin-related applications and systems (including Garmin Connect, Garmin Express, Launcher... etc.) will be suspended; in addition, Garmin official website online store services and some pages may not be displayed normally.

[Only registered and activated users can see links. ]