UFP Technologies, a Massachusetts-based medical device maker, said it is investigating a cyberattack in mid-February that led to some of its company data being stolen or potentially destroyed, according to a regulatory filing.
The company said the attack, which was detected Feb. 14, impacted most of its IT network, as well as its billing and label-making capabilities for customer deliveries. The company said it was able to continue operations using data backups and implementing contingency plans.
“This was a classic ransomware attack that appeared to have impacted many, but not all, of our IT systems,” Ronald Lataille, chief financial officer at UFP Technologies, said Wednesday on a quarterly conference call with analysts. “Data was taken and then destroyed.”
The company is still trying to figure out how much sensitive information, including personally identifiable data, may have been impacted by the attack, according to the 8-K filing with the Securities and Exchange Commission. However, the company does not currently believe the attack will have a material impact on its financial condition.
UFP Technologies has insurance coverage, and company executives said they believe most of the direct costs related to containing, investigating and mitigating the attack will be reimbursed. The firm is also evaluating what additional regulatory filings will be required.
Lataille said the company believes that its primary information systems will be restored this week.
During the conference call, UFB Technologies chairman and CEO R. Jeffrey Bailly told analysts some product shipments might be delayed.
Lataille said there may be some softness during February due to the attack impact, but the company will be able to make up for that during the month of March.
