Cadre Holdings
Cadre Holdings cyberattack disrupts production and orders
Summary
A July 2024 cyberattack disrupted Cadre Holdings’ systems, production and order fulfillment. Some operations were still resuming in August; the company reported recovery by November after a separate September incident. Ransomware, data theft and responsibility remain unconfirmed.
Key facts
Timeline
-
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Unknown data impact
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Manufacturing or production disruption
Manufacturing, production, assembly, processing, or industrial operations were reduced, stopped, or impaired.
-
Supply chain disruption
Procurement, inventory, warehousing, shipping, delivery, vendor, or other supply-chain processes were materially affected.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
A July 2024 cyberattack disrupted Cadre Holdings’ systems and some safety-equipment operations. In a July 19 SEC filing, the Jacksonville, Florida-based company said it discovered unauthorized access July 15. It isolated certain systems, engaged outside investigators and notified federal law enforcement. Discovery does not establish when the intruder first entered the environment.
The incident is resolved on the strength of a later positive operational recovery statement. The reviewed sources do not establish an exact first-access or complete restoration date.
Operational significance
The company’s Aug. 9 update confirmed production limits at multiple facilities. It said the threat was contained, but described affected operations as either resumed or still resuming. That qualified statement did not establish full operational recovery by early August. Cadre reduced its annual financial guidance because of the production interruption.
In a Nov. 6 update, Cadre said all affected business operations had resumed. It also disclosed a separate September cyber incident, describing that later event as negligible. Both events prompted containment measures and temporarily disrupted production and order fulfillment at selected business units. They should not be treated as one uninterrupted intrusion.
The third-quarter filing combines some financial effects of the two events; those figures cannot be assigned wholly to July. The company’s general order backlog also does not establish an attack-created backlog.
In a March 10, 2026, results release, Cadre attributed unusually high shipments in the fourth quarter of 2024 to the cyber incident in the preceding quarter. That retrospective statement describes shipment timing; it does not separate July’s effects from September’s or establish when every affected operation recovered.
Confidence and uncertainty
Cyber involvement and disruption are directly documented by Cadre. SecurityWeek’s original report suggested ransomware might be involved, presenting it as an inference. The reviewed company disclosures do not confirm encryption, an extortion demand, payment, data theft or an identified responsible operator.
Cadre’s 2025 annual report later described the two 2024 events as temporary interruptions and said their effects, individually or together, were not material to its financial condition or results. That financial assessment does not negate the documented operational disruption. Generic risk disclosures about ransomware or personal information are not findings that those outcomes occurred in this event.
Analytic gaps
The initial access method, exact first-access time, affected business units and sites, and any event-specific data impact remain unresolved. References to multiple facilities do not establish that every subsidiary, plant or customer was compromised.
Aug. 9 is the latest reviewed, dated statement showing July-event recovery still in progress. The Nov. 6 recovery statement supplies an outer bound rather than an exact restoration date. An exact restoration date remains unverified. Later filings and the separate September incident do not themselves extend July’s operational timeline.
Organizations involved
Impacted locations
Duval County, Florida
Duval County contains Cadre’s principal executive offices at 13386 International Parkway. Production disruption at unnamed facilities does not establish a countywide outage or intrusion into county government.
Jacksonville, Florida
Jacksonville contains Cadre’s principal executive offices at 13386 International Parkway. The company described disruption at multiple unnamed facilities; an attack at this office or citywide outage has not been established.
Sources
We reported that unauthorized access prompted Cadre to isolate systems, disrupting some operations.
Cadre said it determined July 15 that an unauthorized party had accessed its systems. It isolated some systems and reported operational effects.
The report described the company disclosure and suggested ransomware as a possibility, without identifying a group claiming responsibility.
Cadre said the intrusion was contained, while some affected operations were still resuming. Production had been limited at multiple facilities.
Cadre said all affected operations had resumed after the July incident and a separate September incident that also interrupted production and order fulfillment.
The company described combined July and September effects on production, order fulfillment and quarterly results.
Cadre linked unusually high fourth-quarter 2024 shipments to the cyber incident in the preceding quarter.
Cadre described the July and September 2024 incidents as temporary interruptions and said their effects were not material to its financial condition or results.
See something that needs correction?
Signed-in members can report an error, update, or missing source.