Bridgestone Americas
Bridgestone Americas cyberattack disrupts manufacturing
Summary
A September 2025 cyber incident paused manufacturing work at some Bridgestone Americas facilities, including reported U.S. production sites in Aiken County, South Carolina. The company later restored network connections and began increasing output, but the reviewed evidence does not establish ransomware, an actor or a complete recovery date.
Key facts
Timeline
-
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Unknown cyber mechanism
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
Data impacts
-
Unknown data impact
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
Operational impacts
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Manufacturing or production disruption
Manufacturing, production, assembly, processing, or industrial operations were reduced, stopped, or impaired.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
-
Staff sent home or placed on leave
Employees were sent home, placed on administrative leave, furloughed, or otherwise removed from normal duties because of the incident.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
Bridgestone Americas experienced a confirmed cyber incident that interrupted manufacturing operations in September 2025. We initially reported affected work at U.S. plants; subsequent company responses established production pauses and a phased restart.
WRDW/WAGT’s Sept. 1 report recorded the company’s acknowledgment of affected manufacturing work. Employees could perform preventive maintenance with full pay or leave without pay. Its broad business-continuity assurances did not mean every production task continued normally.
Operational significance
The company told Cybersecurity Dive that some manufacturing locations paused operations and were returning gradually. A forecast of full operation within days was not a verified restoration milestone.
By Sept. 17, connections between facilities and the central network had been restored, but production was still increasing toward pre-incident levels. The company described manufacturing and retreading interruptions in North America and Latin America. Network reconnection and full production recovery are separate milestones.
The U.S. reporting identified two production facilities in Aiken County, South Carolina. The reviewed evidence does not establish that every U.S. plant in our initial footprint list was affected. Nashville is the corporate headquarters anchor; the reported factory disruption should not be generalized to an outage across that city.
Confidence and uncertainty
Confidence is high that this was a cyber incident with material manufacturing disruption because Bridgestone confirmed both in direct responses to reporters. Its initial assessment was that customer data and interfaces were not believed compromised, while forensic work continued. That qualified assessment does not establish the final condition of every data category.
Ransomware involvement and actor attribution remain unresolved. The reviewed company responses did not identify ransomware or an actor. The company’s separate 2022 ransomware incident and claims concerning other automakers do not establish the mechanism or responsibility for this event.
Analytic gaps
The precise intrusion and detection dates, entry method, full affected-site inventory, lost output, recovery cost and final data findings remain unestablished. The Sept. 17 update did not provide a complete capacity-restoration timetable.
The latest verified observation of continuing operational effects is Sept. 17, 2025, when output was still ramping up. No authoritative complete-recovery date was found through Oct. 23, 2026. Operations are presumed resolved based on elapsed time; the previous draft’s Sept. 15 end date is unsupported.
Organizations involved
Impacted locations
Aiken County, South Carolina
County-level physical anchor for the two Aiken County manufacturing facilities identified in reporting. Official company directory lists Aiken County tire plants with Graniteville and Trenton postal addresses; mailing names do not alone establish incorporated-city containment. This is not countywide impact or a governmental service overlay.
Nashville, Tennessee
Preserves the established Nashville corporate-victim headquarters anchor. Reviewed reporting establishes manufacturing disruption elsewhere; this relationship does not assert a Nashville plant outage or citywide disruption.
Sources
Our initial report described affected employees being offered maintenance work or unpaid leave.
The company confirmed affected manufacturing work, preventive maintenance alternatives and unpaid leave options.
Bridgestone directly confirmed a cyber incident affecting manufacturing; ransomware was not confirmed.
Company spokesperson described paused manufacturing and gradual return to operation, expecting completion in coming days.
Connections to the central network were restored, but affected manufacturing and retreading facilities were still ramping output.
See something that needs correction?
Signed-in members can report an error, update, or missing source.