German steel mill blast furnace attack, 2014

What happened. In December 2014, Germany’s Federal Office for Information Security (BSI) included a short case in its annual report: a cyberattack on a steel mill that left a blast furnace unable to shut down in a controlled way and caused massive damage to the plant[1][2].

Why it matters. It has since become one of the most cited examples of a cyberattack causing physical damage.

About this analysis. This analysis sets out, stage by stage, what the sources support and where they run out. It reflects the best available information as of October 22, 2026; new information could confirm, change or discredit parts of it.

Highlights

BSI reported that a spear-phishing attack gave intruders a foothold on a steel mill’s office network, from which they reached production. A blast furnace could not be shut down in a regulated way, and the plant was massively damaged[2][1].
How the attackers entered the plant network, and what physically caused the damage, were never disclosed. The plant and the attacker were never officially named, and the company most often linked to it has denied being the victim[2][3].
A 2022 Idaho National Laboratory reconstruction, built from public reports, adds malware, a second entry route and cost estimates. None of it has been independently corroborated[4].

Attack flow

Updated: 2026-10-22
Intent: Malicious [confirmed]
Threat actors: Not attributed [unknown | No public attribution]
Access vector: Phishing [confirmed]; Drive-by Compromise [reported]
IT impact: Not disclosed [unknown | No IT technique in the record]
OT targeting: Direct OT Compromise [confirmed]
OT sophistication: Unknown [unknown | Evidence does not decide]
OT impact: Inhibit Response [reported | T0814]; Loss / Denial of Control [reported | T0813, T0827]; Loss of Safety [reported | T0880]
Perils: Overheating [primary]; Loss of Containment [implied]; Fire [implied]
Financial losses: Assets & Equipment [confirmed | $4M est.]; Business Interruption [implied | $6M est.]; Health, Safety, Casualty [implied]; Hardware Bricking [implied]; Cyber Incident Response [implied]

What happened

BSI’s account is brief, and it is known in detail through two sources that quote it: the SANS case study in English and the German news site t-online. A spear-phishing email and an advanced social engineering attack gave the adversary access to the plant’s office network, from which it worked its way into the production network. Failures of control components, and of whole systems, accumulated until a blast furnace could not be shut down in a regulated way. The furnace was left in an undefined state, and the plant suffered massive damage[2][1]. BSI described an adversary with knowledge of both conventional IT security and industrial control and production processes[2][5], and SANS found no indication of harm to human life[2].

Much of what is often said about this incident goes further than that. SANS, writing two weeks after the report, stated that no information was presented on how the adversary moved into the production network, or on the final stage that led to physical damage. It rated the available technical detail at 2 on a five-point scale, judged the story probably true rather than confirmed, and noted that BSI was the only source to have reported it. Its authors believed the damage was intentional, and presented that as their own inference, not as a finding of the report[2].

BSI did not name the plant. Later accounts connected it to the Schwelgern 2 blast furnace at ThyssenKrupp’s Duisburg site, based on the timing of a shutdown the company announced on May 16, 2014; the Idaho National Laboratory calls that furnace the likely target and dates its return to service to October 20, 2014[4]. ThyssenKrupp has denied being the victim. In 2016 a company spokesperson said an external audit had shown the claim to be untrue[3][6].

In 2022, Idaho National Laboratory (INL) published a reconstruction under the US Department of Energy’s CyOTE program, built from publicly available reports. It attributes the intrusion to the Havex malware, dates the initial access most likely to around February 14, 2014, adds a second entry route, and describes a mechanism for the damage: the malware’s active scanning likely caused a denial of service on OT systems that were 21 years old, leading to loss of control and to the furnace overheating beyond its standard temperature of 2,000°F[4]. That account is far more detailed than anything published in 2014, but it was written eight years later from public sources, and we have not been able to corroborate its specific findings.

Intent: malicious

A deliberate intrusion is not in doubt: BSI described a spear-phishing email and an advanced social engineering attack[2], so the path starts at Malicious.

What remains open is whether the damage itself was the goal. The SANS authors believed it was[2]. INL’s reconstruction describes an espionage tool whose scanning overwhelmed fragile equipment[4]. Both readings involve a malicious intrusion; they differ on whether the physical outcome was intended.

Threat actors: not attributed

No government, company or researcher has publicly attributed the attack. BSI named no actor, and SANS listed industrial sabotage for competing contracts or national interests, environmental extremists, and an individual or group testing its capabilities as possibilities, without favoring any of them[2]. No threat actor is highlighted on the map for that reason.

Later claims do not settle the question. INL attributes the intrusion to the Havex malware but names no group[4]; other reporting, such as ISSSource in 2015, ties Havex to the campaign known as Energetic Bear or Dragonfly[7]. ISSSource also reported that the attack was most likely an inside job, relying on anonymous and second-hand sources, including a remark that it had been attributed to Russia[7]. SANS had judged an insider unlikely, given that the attack began with a phishing email[2].

Access vector: spear-phishing, and possibly more

Spear-phishing is the one access vector confirmed by the authority that reported the incident[2]. It is highlighted as confirmed.

INL adds drive-by compromise, including a trojanized software update from an equipment vendor, as a second route used to install Havex on IT hosts[4]. It is shown as reported, with a dashed outline, because it is INL’s reading of public reports rather than a statement by BSI.

IT impact: not disclosed

Neither BSI nor SANS describes what the adversary did on the office network beyond using it to reach the plant[2]. The steps INL describes are movement and reconnaissance rather than impacts on IT systems: valid credentials used to move laterally, and Havex enumerating the devices connected to control-system workstations[4]. No source describes data being encrypted, destroyed or stolen in this incident, so this stage is marked Not disclosed and its links are dashed.

Readers may come across ThyssenKrupp’s 2016 disclosure of an espionage breach in which trade secrets were taken. That is a separate incident, and the company said at the time that the systems running its Duisburg blast furnaces were unaffected[8][9].

OT targeting: a direct compromise

In every account, the intrusion reached and affected the production network itself, not only IT systems that production depends on[2][4]. That makes this a direct OT compromise.

For an insurer, this is the stage where a cyber event meets the property schedule. The asset at risk was a blast furnace.

OT sophistication: unknown

BSI rated the attackers’ technical skills as very advanced[5], and the attack is widely described as sophisticated. On the OT side specifically, the evidence does not decide it. If the attackers deliberately manipulated the furnace’s shutdown logic, the attack would be sophisticated, in the same family as Stuxnet. If the damage came from malware scanning that overwhelmed 21-year-old control equipment, as INL suggests, it would be a crude, denial-style effect with no deliberate manipulation of the process[4].

Neither of the sources produced closest to the event had the plant-network detail needed to choose between those readings[2], so we classify OT sophistication as Unknown.

OT impact: loss of control and of the safe shutdown

The effect on the plant is well established, even though the mechanism is not: critical process components became unregulated, and the furnace could not be shut down in a regulated way[2][1]. MITRE’s own description of the Loss of Control technique cites this incident[10].

The specific techniques come from INL’s reconstruction. It classifies the effect as Loss of Control and Denial of Control, and the failure of the furnace’s blowdown process to start as Loss of Safety[4][11]. Its proposed mechanism, a denial of service caused by Havex scanning old equipment, sits under Inhibit Response, and INL states it as likely, not established[4]. All three are shown as reported. Techniques sometimes attached to this incident, such as manipulating alarms or spoofing what operators saw, are not supported by any source we reviewed.

Perils: overheating

The primary peril is overheating, the only physical mechanism any source names. INL says the loss of control led the furnace to overheat beyond its standard temperature of 2,000°F; no source gives the peak temperature[4].

Loss of containment and fire are implied, not reported. A blast furnace that cannot be shut down in a regulated way and overheats can lose containment of hot metal or gas, and an ignited loss of containment is a fire. No source states that either happened, so both are shown with a dotted outline.

The path reaches a peril only after it reaches the plant’s control systems.

Financial losses: what it cost

No source from 2014 gave any amount. INL’s 2022 reconstruction provides two estimates: roughly $4 million to repair the blast furnace and its control-system equipment, and $6 million in lost revenue and productivity[4]. INL presents both as estimates and shows no derivation. The repair is tied to damage BSI confirmed; the lost revenue depends on linking the BSI case to the Schwelgern 2 outage, which remains circumstantial, so its occurrence is implied rather than confirmed. We report both figures as published, with one caution: about five months offline for $6 million in lost revenue is low for an integrated steel plant.

Loss evidence

Confirmed: Blast furnace and control-system repair
Estimated: $6M Lost revenue and productivity (occurrence implied); $4M Blast furnace and control-system repair
Estimate note: From INL’s 2022 reconstruction[4], which gives no total. The sum is ours.
Implied: Lost revenue and productivity; Asset degradation; Startup and return-to-service validation; Process safety engineering; Embedded device replacement; Network event response and recovery; Voluntary improvements; Computer and laptop replacement
Not supported: Loss of life; Network device replacement; Server replacement; Regulatory action or liability; Unauthorized resource consumption

Health, safety and casualty is implied, not confirmed. An uncontrolled blast furnace is the kind of event that can kill people, and SANS found no indication of harm to human life[2]. The implied cost is the engineering needed to fix a protective shutdown that failed when it was needed.

What this incident shows

The steel mill is a reminder of how much of an incident’s reputation can rest on how little evidence. What the record supports is still significant: an intrusion that began with a phishing email reached a plant network and ended with a blast furnace out of control and badly damaged. What it does not support, despite wide repetition, is a confirmed account of deliberate, engineered sabotage.

The lesson for anyone assessing industrial cyber risk does not depend on which reading is right. Both run through the same two weaknesses the sources identify: a route from the corporate network into the plant network[2], and aging control equipment that could not tolerate unexpected network traffic[4].

References

t-online. “BSI-Sicherheitsbericht: Hacker sabotieren deutsches Stahlwerk” (BSI security report: hackers sabotage German steel mill). t-online, 18 Dec. 2014. t-online.de/digital/aktuelles/id_72215736/bsi-sicherheitsbericht-hacker-sabotieren-deutsches-stahlwerk.html
Lee, Robert M., Michael J. Assante, and Tim Conway. “ICS CP/PE (Cyber-to-Physical or Process Effects) Case Study Paper: German Steel Mill Cyber Attack.” SANS ICS Defense Use Case (DUC), 30 Dec. 2014. media.kasperskycontenthub.com/wp-content/uploads/sites/20/2015/04/20000144/ICS-CPPE-case-Study-2-German-Steelworks_Facility.pdf
“ThyssenKrupp Suffers Professional Hack Attack.” The Chemical Engineer, 9 Dec. 2016. thechemicalengineer.com/news/thyssenkrupp-suffers-professional-hack-attack/
Idaho National Laboratory / DOE CESER CyOTE Program. “Precursor Analysis Report: Cyber Attack on Thyssenkrupp Blast Furnace 2014.” CyOTE Case Study, INL/RPT-22-70679, 31 Dec. 2022. cyote.inl.gov/content/uploads/24/2025/12/CyOTE-Case-Study_Thyssenkrupp.pdf
IDG News Service. “Cyberattack on German Steel Factory Causes Massive Damage.” PCWorld, 19 Dec. 2014. pcworld.com/article/430938/cyberattack-on-german-steel-factory-causes-massive-damage.html
Reuters. “ThyssenKrupp Reports Cyber Attack of Steel Plants.” Business Insurance, 8 Dec. 2016. businessinsurance.com/article/20161208/NEWS06/912310882/ThyssenKrupp-reports-cyber-attack-of-steel-plants
Sale, Richard. “German Steel Mill Attack: Inside Job.” ISSSource, 9 Sept. 2015. isssource.com/german-steel-mill-attack-inside-job/
Reuters. “German Steelmaker ThyssenKrupp Discloses ‘Massive’ Cyber Attack.” Fortune, 8 Dec. 2016. fortune.com/2016/12/08/thyssenkrupp-cyber-attack
Jowitt, Tom. “Hackers Pilfer Trade Secrets In ThyssenKrupp Cyber Attack.” Silicon UK, 9 Dec. 2016. silicon.co.uk/security/cyberwar/hackers-thyssenkrupp-attack-201815
MITRE. “Loss of Control, Technique T0827 - ICS.” MITRE ATT&CK for ICS, version 1.0 (last modified 12 May 2026). attack.mitre.org/techniques/T0827/
MITRE. “Denial of Control, Technique T0813 - ICS.” MITRE ATT&CK for ICS, version 1.1. attack.mitre.org/techniques/T0813/