Skip to content
DysruptionHub
Sign in Subscribe

Artivion cyberattack disrupts manufacturing and shipping

Summary

Artivion logo

Artivion’s November 2024 cyberattack involved file acquisition and encryption and disrupted manufacturing, order processing and shipping. Later disclosures described personal-information impact, recovery and a tissue-processing backlog.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted location

Organization types

Critical infrastructure sector

DysruptionHub coverage

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Resolved
Incident confidence:
High
Ransomware:
Unresolved

Attack mechanisms

Data impacts

  • Data theft or exfiltration

    Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.

  • Data encryption

    Data was rendered inaccessible through unauthorized encryption, including ransomware-related encryption.

Operational impacts

  • Partial service outage

    A service, system, platform, or operational capability remained available only in part or with significant limitations.

  • Network outage

    Internal or external network connectivity was unavailable or materially impaired.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Manufacturing or production disruption

    Manufacturing, production, assembly, processing, or industrial operations were reduced, stopped, or impaired.

  • Supply chain disruption

    Procurement, inventory, warehousing, shipping, delivery, vendor, or other supply-chain processes were materially affected.

  • Service delay

    Services continued but with longer processing, response, delivery, or completion times.

  • Backlog created

    The disruption caused an accumulation of unprocessed requests, cases, orders, records, appointments, or other work.

Extortion indicators

  • Unknown extortion indicators

    The incident may involve extortion, but available evidence does not establish which extortion indicators were present.

Incident narrative

What happened

Artivion, a Georgia-based medical device company, identified a cyberattack Nov. 21, 2024, and took some systems offline. In its Dec. 9 SEC disclosure, the company confirmed that files had been acquired and encrypted. It engaged outside cybersecurity, forensic and legal specialists to investigate and restore systems.

Operational effects

The company continued supplying products and services, but some order-processing, shipping and corporate functions were disrupted. Its 2024 annual report also described effects on enterprise resource planning systems and manufacturing.

By Feb. 24, 2025, Artivion reported normal operating levels across the business, with residual inefficiencies still being addressed. Its May 5 results announcement described a return to normal operations and a short-term tissue-processing backlog that reduced preservation-services revenue in the first quarter. The reviewed disclosures do not establish an exact final restoration date.

Information obtained

Later breach notices established that an unauthorized party accessed the network between Nov. 20 and Nov. 21, 2024, and obtained files. An employee and family notice described information that varied by person, potentially including identifying documents, direct-deposit details and health insurance information. The company offered two years of credit monitoring.

A separate notice concerning medical-device information listed names, device details and implant dates and locations. That notice said the affected file excluded Social Security numbers, financial information and treatment or diagnosis information. Those exclusions applied to that recipient group.

Financial effects and unresolved details

Artivion’s annual report described a $4.6 million impact on its 2024 results and efforts to recover covered losses through insurance. Subsequent financial disclosures continued to report incident-related amounts, including recoveries; these figures are distinct from a ransom payment or a final total loss.

The reviewed company disclosures do not identify the attacker, explain the initial entry method or establish a ransom demand or payment. They also do not establish that the manufacturing and shipping disruption caused canceled medical procedures or patient harm.

Organizations involved

Impacted location

  • Cobb County, Georgia

    The affected company’s headquarters is physically in unincorporated Cobb County at 1655 Roberts Boulevard NW. Kennesaw is its postal locality. County-level site geography records the verified physical anchor; it does not establish countywide disruption, compromised servers at that office, or effects at every company affiliate.

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.