Crown Equipment
Crown Equipment cyberattack halts manufacturing
Summary
A June 2024 cyberattack disrupted Crown Equipment’s business systems and suspended manufacturing from June 10. The company announced all 24 global plants had resumed by July 1. It later confirmed unauthorized access to employee-related records; ransomware and a named operator remain unverified.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing. -
Incident end:
?
Confirmed or defensibly assessed end of material operational disruption or incident activity.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
DD-CIT assessment
The organization publicly identifies the event as cyber-related. The organization publicly documents the resulting service disruption.
Attack mechanisms
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Unauthorized data access
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Website unavailable
A public-facing website was unavailable, disabled, or inaccessible.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Records processing disruption
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
-
Manufacturing or production disruption
Manufacturing, production, assembly, processing, or industrial operations were reduced, stopped, or impaired.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
Extortion indicators
-
No known extortion indicator
Available evidence indicates that no extortion demand, threat, communication, or related pressure tactic was identified.
Incident narrative
Analyst assessment
A June 2024 cyberattack disrupted Crown Equipment’s business systems and halted manufacturing at its global plants. The Ohio-based forklift manufacturer announced on July 1 that all 24 plants had resumed operations after a suspension beginning June 10. Cyber involvement and substantial production effects are confirmed; Crown did not publicly confirm ransomware or name an operator.
Crown’s notification letter says it discovered unauthorized access June 9, while its California breach filing gives June 8 as the breach date. A Maryland filing submitted by Crown’s counsel also describes discovery around June 8, while its attached employee letter says June 9. The records leave that one-day discrepancy unresolved. July 1 establishes the announcement of completed manufacturing recovery, without implying every plant restarted simultaneously that day.
Operational significance
Dayton Daily News reporting described employee messages announcing manufacturing suspensions in the New Bremen area and at other plants. Messages also named Troy, Celina, Minster, New Knoxville and Fort Loramie among communities awaiting a restart. Anticipated restart dates in employee communications were forecasts.
The Daily Standard separately quoted a company spokesman about interruptions at Celina and New Bremen. He cautioned that every function had not stopped. Crown’s July release says retail sales, service and office functions continued operating while production was paused and subsequently returned to normal.
BleepingComputer reported difficulties with timekeeping, service manuals and some machinery deliveries. Local coverage also documented website and telephone-transfer problems. The evidence supports production and business-process disruption, with effects varying across functions.
Confidence and uncertainty
Confidence is high in the cyber and manufacturing-impact findings because Crown’s own statements and independent reporting corroborate them. The Aug. 9 company update also confirms unauthorized access to employee-related benefits, retirement and workplace-injury records, including some family members’ information.
The Maryland filing says Crown began notifying affected people Aug. 8, 2024. The notification letter says the main human-resources database was not accessed, while other administrative records were compromised. Its examples of sensitive information do not establish that every affected person had every listed field exposed.
Crown said federal law enforcement and cybersecurity partners undertook protective operations and expressed confidence that affected data could not be misused. That is the company’s assessment, rather than an independently established guarantee about future misuse.
Analytic gaps
A reported employee email linked entry to unauthorized access to an employee device. More detailed social-engineering, remote-access-software, encryption and ransom allegations remain unconfirmed. The public evidence does not establish a named group, data publication, ransom demand or payment.
The precise first-access time and plant-by-plant recovery sequence remain unknown. The notification’s broader description of normal business returning within days does not resolve the interim manufacturing chronology. Later data notifications do not establish a new outage.
Organizations involved
Impacted locations
Greencastle, Indiana
Greencastle contains Crown’s manufacturing site at 2600 East State Road 240. Reporting named Greencastle during the manufacturing suspension. This Putnam County site is separate from Crown’s New Castle facility in Henry County.
Henry County, Indiana
Henry County contains Crown’s New Castle manufacturing facility on I Avenue. Reporting named New Castle during the manufacturing suspension, separately from Greencastle in Putnam County. This county link represents that physical site.
Putnam County, Indiana
Putnam County contains Crown’s Greencastle manufacturing site at 2600 East State Road 240. Employee messages reported during the incident named Greencastle separately from New Castle. This link represents the Greencastle site’s physical county.
Kinston, North Carolina
Lenoir County, North Carolina
Lenoir County contains Crown’s manufacturing site on Dobbs Farm Road near Kinston. It is a physical anchor for the affected manufacturer. The Kinston mailing address does not resolve whether the entire factory and adjacent expansion are within the incorporated city.
Auglaize County, Ohio
Auglaize County contains Crown’s New Bremen headquarters and manufacturing sites in New Bremen, Minster and New Knoxville. The manufacturer reported a production suspension. This is a physical anchor for Crown, not a countywide outage.
Celina, Ohio
Celina contains Crown’s manufacturing site at 410 Grand Lake Road. Reporting identified Celina during the manufacturing suspension; anticipated restart dates in employee messages were forecasts.
Fort Loramie, Ohio
Fort Loramie contains Crown’s site at 300 Tower Drive. Employee messages reported during the incident named Fort Loramie among the affected manufacturing communities.
Mercer County, Ohio
Mercer County contains Crown’s Celina manufacturing site at 410 Grand Lake Road. Reporting identified Celina among the manufacturing communities affected by the production suspension. The county link represents that physical site.
Miami County, Ohio
Miami County contains Crown’s Troy manufacturing site on South Dorset Road. Reporting named Troy among the manufacturing communities affected by the production suspension. The county link represents Crown’s physical presence.
Minster, Ohio
Minster contains Crown’s manufacturing site at 245 Boulder Lane. Employee messages reported during the incident named Minster among the communities awaiting a production restart.
New Bremen, Ohio
New Bremen contains Crown’s headquarters and manufacturing plants. Company and local reporting confirm the manufacturing suspension and later restart; the site link does not imply a village-government intrusion.
New Knoxville, Ohio
New Knoxville contains Crown’s manufacturing site on State Route 219. Employee messages reported during the incident named New Knoxville among the communities awaiting a production restart.
Shelby County, Ohio
Shelby County contains Crown’s Fort Loramie site at 300 Tower Drive. Reporting named Fort Loramie during the manufacturing suspension. This physical anchor does not establish a county-government intrusion.
Troy, Ohio
Troy contains Crown’s manufacturing site on South Dorset Road. Employee messages identified Troy during the production suspension; a forecast restart is not a verified plant-specific recovery date.
Sources
We reported disruptions to Crown’s production and business systems, drawing on BornCity’s June 19 account.
The June 13 report describes website unavailability and production concerns, citing employee and social media accounts.
Specialized cybersecurity reporting contemporaneous with Crown’s June 19 confirmation; includes additional context and claimed internal email details not typically captured in local business coverage.
The June 19 report describes production and IT problems and relays ransomware, entry-method and ransom allegations from unnamed and indirect sources.
Local/regional reporting on Crown’s June 19 acknowledgment of the cyberattack, including early operational impacts and references to internal communications and law-enforcement awareness.
Regional TV newsroom coverage reporting Crown’s confirmation of the cyberattack and the temporary shutdown of operating systems to investigate and resolve the incident.
Local-area reporting (Auglaize/Mercer region) summarizing Crown’s June 19 release and community impacts near New Bremen, including references to federal involvement.
Local follow-up describing Crown’s July 1 statement that operations resumed, contextualizing the duration of manufacturing disruption and local workforce impact.
Corporate newsroom statement announcing operations resumed at all 24 global manufacturing plants and that sales/service and office functions returned to normal; states manufacturing had been suspended since June 10 due to a cyberattack and references a prior June 19 announcement.
Breach-notice template hosted by the California Attorney General. States Crown discovered unauthorized access on June 9, 2024, took systems offline, retained incident-response support, and describes categories of data potentially involved.
California AG repository landing page for Crown’s breach-notification sample. Lists the breach date(s) as June 8, 2024 and links to the notice-letter template PDF.
Official FAQ document summarizing what happened, high-level response actions, and law-enforcement coordination (including FBI notification/cooperation) and describing impacted populations (current/former employees and, in some cases, family members).
Company update describing investigation findings that an unauthorized third party accessed certain Crown records (including accident/injury reports and benefits/retirement participation records) and that notices were provided to employees.
Crown describes its New Bremen origins, lift-truck production, component manufacturing and dealer network, and lists headquarters at 44 S. Washington St.
The Statehouse account describes Auglaize County’s 1848 establishment, river namesake, agricultural and industrial heritage, and Neil Armstrong’s birthplace.
The city describes Celina as Mercer County’s seat, its founding by James Watson Riley in 1834 and the layout of Main and Market streets.
DePauw describes Greencastle residents’ fundraising to attract the university, its 1837 charter and East College’s 1870 cornerstone.
The city describes Celina’s setting beside Grand Lake St. Marys.
The village history describes the former Berlin name, post-War of 1812 settlement, canal-era immigration and the Lake Loramie reservoir.
The village describes German settlement in 1832, the original Stallostown name, renaming in 1836 and the canal’s arrival in 1843.
The State Library identifies Putnam County in west-central Indiana, created in 1822 from portions of Owen and Vigo counties and unorganized territory, with Greencastle as its seat.
The Statehouse account describes Celina as Mercer County’s seat, Hugh Mercer as its namesake, and the county’s agricultural heritage and Grand Lake.
The plan describes Miami County in western Ohio, its 1807 formation, Troy as county seat and the Great Miami River and canal corridor.
The village describes German settlement in the 1830s, Miami and Erie Canal commerce, surviving canal remnants and a restored lockkeepers house.
The county history identifies Greencastle as the county seat and recounts Indiana Asbury University’s 1837 charter and later DePauw name.
The county describes its upper Miami Valley setting, Interstate 75, establishment in 1819, Isaac Shelby namesake and Sidney county seat.
The village describes southern Auglaize County, State Routes 29 and 219, nearby Interstate 75, and its airport and industrial park. It says Crown established its motor plant in 1983.
The conservancy district describes Troy’s position in central Miami County, the Great Miami River, Morgan Ditch and flood-protection works.
Crown’s counsel said notification of affected people began Aug. 8, 2024. The cover letter describes discovery around June 8, while the attached employee notice says June 9. Both describe unauthorized access to employee-related records.
See something that needs correction?
Signed-in members can report an error, update, or missing source.