Analyst assessment
A cyberattack disrupted Crystal D’s communications and business systems in March 2025. The Saint Paul, Minnesota, awards supplier’s March 7 customer notice attributed technical communications problems and delayed responses to a cyberattack earlier that day. Initial reporting placed the loss of phone and email access at approximately 7 a.m. Central time. This is the earliest documented operational disruption, rather than a verified intrusion timestamp.
Operational significance
Some orders scheduled to ship March 7 required rescheduling. By March 12, Crystal D could communicate with customers and process orders again, while work on remaining problems continued. A temporary email channel supported customer contact.
On April 7, company executives said operations were fully restored. Staff had provided quotes and entered orders manually, while customers adjusted dates and competitors offered support. The company reported producing and shipping 97.25% of orders received during the outage on time. That reported continuity figure does not erase individual delays or establish that every production process stopped.
Operational status is assessed as resolved. Restoration was confirmed by April 7, but the exact date systems returned fully to normal is unverified, so no precise end date is assigned.
Confidence and uncertainty
Confidence is high in the cyber cause and business disruption. In its April 7 recovery account, the company said its review had found no evidence that sensitive customer information had been accessed. That is a bounded finding concerning reviewed customer information, rather than proof that no information of any kind was affected.
A later sample notification filed with Massachusetts says Crystal D determined on April 21, 2025, that personal information on its network may have been accessed or acquired. The copy identifies full names but redacts other fields and the letter date. The state’s breach report lists the filing on May 14 and one Massachusetts resident affected, with several personal, medical and financial data categories flagged. That state-specific count is not a nationwide total. Neither document gives the intrusion date or establishes conclusively that the notification concerns the same intrusion as the March operational disruption. These later records therefore raise additional data-impact questions without establishing LockBit’s responsibility.
A separate April 8 FalconFeeds post reported a LockBit claim naming crystal-d.com. Its embedded screenshot shows the matching domain and a roughly 20-day publication countdown. Kaspersky’s June review also reported the claim and linked that post. These sources support recording the allegation; they do not independently establish that LockBit caused the March outage, encrypted systems or stole data. The claim appeared after the company’s restoration announcement and does not establish a second operational attack.
Analytic gaps
The initial access route, complete forensic findings, precise restoration date, any ransom demand or payment, and the outcome of the publication threat remain unverified. The public evidence does not authenticate allegedly stolen files. Claim-reporting dates do not establish when the allegation first appeared on the operator’s site. Attacks on Staples, alphabroder and other suppliers are separate events.
