Honda suffers suspected ransomware attack
So-called "Ekans" ransomware is said to be behind office closures and a halt in manufacturing at some factories


Japanese car giant Honda has been hit by a ransomware attack that has forced it to put manufacturing on hold at some locations.
The ransomware attack was first discovered on Sunday, with Honda putting production on hold in certain locations the following day to deal with a "disruption" in its computer network, according to NBC News.
The most popular ransomware strains targeting UK businesses How to beat ransomware What are the different types of ransomware?
Reports claim Honda employees in the US were also turned away from their offices on Monday morning as IT equipment and phones were still offline.
Cyber security researchers claim to have found evidence that hackers have created a custom variant of the "Ekans", or "Snake", ransomware to encrypt an internal Honda network and demand ransom in exchange for a decryption key.
The so-called "Ekans" ransomware is a type of malware that has been designed to target industrial control systems and to evade anti-malware tools. It was recently used to target Germany-based Fresenius Group, Europe's largest private hospital operator, forcing it to postpone surgical procedures.
Honda has yet to confirm the ransomware attack but did state that it has suffered a security incident that has impacted its operations in Europe.
"This is currently under investigation, to understand the cause," a Honda spokesperson said.
Get the ITPro daily newsletter
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
"At this point, there is no effect on either Japanese production or dealer activities, and no customer impact. In Europe, we are investigating to understand the nature of any impact. We can confirm some impact in Europe and are currently investigating the exact nature.
This is not the first time Honda has been targeted by cyber criminals. One of the company's plants at Sayama, Japan, had to temporarily stop production in 2017 after its network was hit by WannaCry ransomware.
RELATED RESOURCE
How enterprises are embracing cyber security challenges
Enterprises across Europe, the Middle East and Africa are undergoing a significant transformation
In 2019, the carmaker had to deal with another cyber security incident after a researcher discovered a misconfigured ElasticSearch database leaking 134 million corporate documents that exposed sensitive information about the Honda's internal systems and device data.
Carly Page is a freelance technology journalist, editor and copywriter specialising in cyber security, B2B, and consumer technology. She has more than a decade of experience in the industry and has written for a range of publications including Forbes, IT Pro, the Metro, TechRadar, TechCrunch, TES, and WIRED, as well as offering copywriting and consultancy services.
Prior to entering the weird and wonderful world of freelance journalism, Carly served as editor of tech tabloid The INQUIRER from 2012 and 2019. She is also a graduate of the University of Lincoln, where she earned a degree in journalism.
You can check out Carly's ramblings (and her dog) on Twitter, or email her at hello@carlypagewrites.co.uk.
-
M&S suspends online sales as 'cyber incident' continues
News Marks & Spencer (M&S) has informed customers that all online and app sales have been suspended as the high street retailer battles a ‘cyber incident’.
By Ross Kelly
-
Manners cost nothing, unless you’re using ChatGPT
Opinion Polite users are costing OpenAI millions of dollars each year – but Ps and Qs are a small dent in what ChatGPT could cost the planet
By Ross Kelly
-
Ransomware attacks are rising — but quiet payouts could mean there's more than actually reported
News Ransomware attacks continue to climb, but they may be even higher than official figures show as companies choose to quietly pay to make such incidents go away.
By Nicole Kobie
-
Cleo attack victim list grows as Hertz confirms customer data stolen – and security experts say it won't be the last
News Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
By Ross Kelly
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackers
News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
By Emma Woollacott
-
Healthcare systems are rife with exploits — and ransomware gangs have noticed
News Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
By Nicole Kobie
-
Alleged LockBit developer extradited to the US
News A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
By Emma Woollacott
-
February was the worst month on record for ransomware attacks – and one threat group had a field day
News February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
By Emma Woollacott
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impacted
News The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
By Solomon Klappholz
-
Warning issued over prolific 'Ghost' ransomware group
News The Ghost ransomware group is known to act fast and exploit vulnerabilities in public-facing appliances
By Solomon Klappholz