Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →VARTA said a cyberattack on the night of February 12, 2024, forced it to disconnect parts of its IT environment and temporarily stop production at five plants. The German battery maker treated the shutdown as a security precaution while it investigated the intrusion and checked data integrity. On February 22, it still could not reliably predict when all sites would be fully operational; later annual reports described a gradual recovery rather than an immediate return to normal.
What happened to VARTA
In an issuer disclosure dated February 13, VARTA said an attack on parts of its IT systems affected five production plants and administration. The company proactively shut down the affected IT systems and production and disconnected them from the internet “for security reasons.” Read the original disclosure from VARTA via EQS News.
That wording describes a containment decision, not proof that every factory was destroyed or permanently disabled. VARTA said it was assessing the impact and working to protect the integrity of its systems and data.
How production was affected
Five global sites were in scope
VARTA’s February 22 update named the five production locations as Ellwangen, Nördlingen and Dischingen in Germany, Brasov in Romania, and Batam in Indonesia. The company said the attack affected those sites as well as administrative operations.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- Includes one X-pack of Varta Longlife AAA Batteries
- Shelf life of up to 10 years* protects the functionality of each alkaline battery so they remain usable even after prolonged storage
- Leak-resistant design of these triple AAA batteries prioritizes the safety of your devices and the surrounding environment
- Triple A batteries contain zero added Mercury and Cadmium
- You can use alkaline AAA batteries to power various electronics, from wireless keyboards to remote controls
Production could not immediately resume everywhere
On February 22, VARTA said a task force, forensic experts and data analysts were testing and recommissioning systems step by step. It had “no reliable information” about when the attack would be fully processed or when production at all five sites would be fully operational. The company expected sections of some plants to restart during the following week, but that was a forecast—not confirmation of an all-site restart.
Maintenance and other preparatory, non-IT work could continue while the technical investigation and staged recommissioning proceeded. The contemporaneous account in The Record summarized the situation as plant production remaining on hold after the attack.
Rank #2
- Includes one 100-pack of Varta Longlife AA Batteries
- Shelf life of up to 10 years* protects the functionality of each alkaline battery so they remain usable even after prolonged storage
- Leak-resistant design of these triple AA batteries prioritizes the safety of your devices and the surrounding environment
- Double A batteries contain zero added Mercury and Cadmium
- You can use alkaline AA batteries to power various electronics, from wireless keyboards to remote controls
VARTA’s timeline, separated by what was known when
| Date or period | What VARTA reported | How to interpret it |
|---|---|---|
| Night of February 12, 2024 | An organised group attacked parts of VARTA’s IT systems. Five production plants and administration were affected; IT and production were temporarily shut down and disconnected from the internet. | Initial containment and investigation; the disclosure did not identify the intrusion method or attacker. |
| February 22, 2024 | Forensic and data teams were testing and restoring systems step by step. VARTA expected some plant sections to restart the next week but could not reliably estimate when all five sites would be fully operational. | A partial-restart expectation, not a confirmed recovery date. |
| 2023 annual report, published later | VARTA said SAP and central production systems were operational again in the short term and that customer and supplier communications had returned to their prior level. | Evidence of important systems coming back online, while the report still described the incident’s operational and reporting consequences. |
| 2024 annual report, published later | Production-related internet data exchange remained limited. VARTA forecast that its IT infrastructure would be almost fully restored by the end of the second quarter of 2025 and described firewall and other critical-system upgrades. | An outlook stated in the report, not independent confirmation that restoration was completed on that date. |
VARTA’s original February update is available as a company PDF.
What the later annual reports add
Short-term recovery in the 2023 report
VARTA’s 2023 annual report said the attack affected large parts of IT at five production sites, sales locations and administrative areas. It reported that SAP and central production systems were operational again in the short term, and that communications with customers and suppliers had returned to the level before the incident.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #3
- Includes one 48-pack of Varta Longlife AAA Batteries
- Shelf life of up to 10 years* protects the functionality of each alkaline battery so they remain usable even after prolonged storage
- Leak-resistant design of these triple AAA batteries prioritizes the safety of your devices and the surrounding environment
- Triple A batteries contain zero added Mercury and Cadmium
- You can use alkaline AAA batteries to power various electronics, from wireless keyboards to remote controls
The same report linked delays in publishing the 2023 financial statements to the consequences of the cyberattack and to the company’s restructuring circumstances. The sources do not support attributing those delays to the attack alone.
Longer recovery outlook in the 2024 report
VARTA’s 2024 annual report said production-related data exchange over the internet was still limited and forecast near-complete IT-infrastructure restoration by the end of Q2 2025. It also described upgrades to firewalls and other critical systems. Because this is a management outlook in a later report, it should not be read as a verified, definitive full-restart date for every production activity.
Rank #4
- Includes one 24-pack of Varta Longlife D Batteries
- Shelf life of up to 10 years protects the functionality of each alkaline battery so they remain usable even after prolonged storage
- Leak-resistant design of these D batteries prioritizes the safety of your devices and the surrounding environment
- D batteries contain zero added Mercury and Cadmium
- You can use alkaline D batteries to power various devices, from flashlights and smoke detectors to electronic toys.
Attribution and investigation
VARTA said it had determined that an organised group of hackers carried out the attack, that authorities had been informed and that police had formally started an investigation. This is the company’s characterization; the reviewed sources do not publicly name the group or provide independent technical attribution.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What has not been established publicly
- No reviewed source identifies a ransomware family, exploited vulnerability, initial-access route or other intrusion technique.
- The sources do not establish that data was stolen or exfiltrated.
- They do not report a ransom demand, ransom payment or named threat actor.
- VARTA did not disclose a final cost, complete financial loss or final insurance recovery. Its February 22 update said possible damage and insurance coverage were still under investigation.
- There is no confirmed date in these sources for a complete return of all production operations.
Those limits matter: an operational shutdown can be confirmed without proving what the attackers accessed or the eventual financial impact.
Best Value
Why the incident mattered beyond the factory floor
Battery manufacturing depends on connected enterprise, production and logistics systems. VARTA’s response shows how isolating IT to contain an attack can interrupt manufacturing even when physical equipment is intact. The later references to restricted production-related internet exchange and firewall upgrades indicate that recovery included rebuilding trusted connectivity, not simply switching machines back on.
For customers and suppliers, the practical effects were changing communication and scheduling conditions: VARTA initially described production as offline, later reported restored customer and supplier communications, and still noted limits on production-related data exchange in its 2024 reporting.
Bottom line for readers following the VARTA attack
The February 2024 incident was a reported cyberattack that temporarily paralysed VARTA’s IT-linked production across five sites. The company disconnected systems as a precaution, restarted components in stages and later reported recovery of SAP and central production systems. However, the public record used here does not establish ransomware, data theft, a perpetrator’s identity, a ransom or a final loss figure, and VARTA’s later full-restoration date was an outlook rather than a confirmed completion.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
