An October 2023 cyber incident disrupted Simpson Manufacturing’s systems and shipments. A later Simpson Strong-Tie notice confirmed unauthorized access to personal information during Oct. 9–11; ransomware and the responsible actor remain unconfirmed.
Unauthorized access to systems, accounts, networks, or data.
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
Internal business, administrative, operational, or staff-facing systems were unavailable.
Procurement, inventory, warehousing, shipping, delivery, vendor, or other supply-chain processes were materially affected.
The disruption caused an accumulation of unprocessed requests, cases, orders, records, appointments, or other work.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
Simpson Manufacturing experienced malicious activity that disrupted its information technology infrastructure, applications and business operations in October 2023. The company took systems offline and engaged outside cybersecurity specialists.
The initial SEC filing identifies disruption on Oct. 10, 2023. Its public filing date was Oct. 11; the report’s event date is distinct from publication. The company later confirmed unauthorized activity on some IT systems. These original statements establish a cyber incident and operational interruption, without identifying an intrusion method or responsible actor.
In a later notice dated March 19, 2024, subsidiary Simpson Strong-Tie said its investigation found unauthorized access from Oct. 9–11, 2023, including access to personal information. The notice explicitly connects that investigation to the Oct. 11 SEC disclosure. This places the known access period a day before the initially reported disruption.
An Oct. 19 filing describes approximately three days of widespread business disruption. In its Oct. 23 earnings release, the company said operations were mostly down for about three days and described resuming shipments to clear its backlog within a week.
The interruption affected a manufacturer of engineered construction products, but the reviewed statements do not identify every affected application, plant or production process. The shipment recovery and containment statements support the existing resolved operational status. Approximate durations do not establish a precise date when every affected function returned.
BlackFog’s 2023 ransomware roundup reports that Black Basta listed Simpson Strong-Tie, a Simpson Manufacturing subsidiary, on its leak site in late October. Ransomware.live records listings under the subsidiary’s name and strongtie.com domain, with discovery times in October and November 2023. These are reported claims associated with the incident, rather than company confirmation of who caused the disruption. The tracker discovery dates do not establish the original post date or separate intrusions.
Confidence in malicious IT activity and business disruption is high. The company said the unauthorized activity had been contained and that law enforcement was notified. The later company notice confirms unauthorized access to personal information. Its public template leaves individual data categories as variable text. A later court-authorized settlement notice describes downloaded files containing personal information of current and former Simpson Strong-Tie employees. That legal account supports a data-copying assessment with moderate confidence; the company’s earlier notice independently establishes access. Neither document confirms ransomware, encryption or the responsible actor. A protective shutdown is not proof of encryption.
The subsequent annual report identifies security changes made in response to the October 2023 incident, including stronger phishing awareness training, device monitoring and visibility into sensitive cloud data. Those measures do not establish the original entry method or a new incident. Later investigation costs and security improvements are distinct from continuing operational disruption.
The later civil case reached a signed judgment on Aug. 7, 2026, after final settlement approval in July. The settlement does not constitute an admission of wrongdoing or liability, and the reviewed documents do not establish that all payments have been distributed. This legal process is separate from operational recovery.
The entry method, complete data scope, affected-system and facility inventory, independently verified actor, any extortion demand or payment, and exact complete-restoration date remain unresolved.
Ransomware.live records a related Black Basta listing under strongtie.com, identifying Simpson Strong-Tie and its Pleasanton office. This is another reported listing, rather than a separately established intrusion. Discovery does not establish original publication or data-release dates. The claim does not independently establish operator responsibility or encryption; a later settlement account describes file downloads without identifying the actor.
Ransomware.live records a Black Basta listing naming Simpson Strong-Tie and identifying strongtie.com and its Pleasanton office. BlackFog reports a late-October subsidiary listing in its account of the parent’s October 2023 interruption. Discovery is distinct from the unknown original post date. The listing does not independently establish responsibility, encryption or an extortion demand. A later settlement notice describes downloaded employee files without attributing the incident to Black Basta. A related November domain listing does not establish a second intrusion.
The companies’ Pleasanton offices at 5956 W. Las Positas Boulevard are in Alameda County. This physical county link complements the existing office-city link without asserting a countywide outage.
Pleasanton is the location of Simpson Manufacturing’s principal executive offices identified in its incident disclosure. The company reported disruption to IT systems and parts of its business operations without identifying every affected facility.
Simpson reported malicious IT activity and business interruption, with some systems taken offline.
The company reported containment after about three days of widespread business disruption.
BlackFog reports that Black Basta listed Simpson Strong-Tie after the parent company’s October interruption.
Simpson Strong-Tie’s notice confirms access to personal information during the Oct. 9–11 intrusion.
The settlement notice describes downloaded employee files, while Simpson Strong-Tie denies wrongdoing or liability.
The signed judgment follows final settlement approval and provides for later implementation oversight.
Signed-in members can report an error, update, or missing source.
