In February 2022 Bridgestone Americas cut many plants off its own network to contain what it later called ransomware, and production stopped. In September 2025 its plants stopped again. Neither time did it name a vector or a cost.
Twice, Bridgestone Americas’ plants stopped. In February 2022 the company disconnected many facilities from its network “out of an abundance of caution.” In September 2025 it contained “a limited cyber incident” under “established protocols,” then restored connections between its facilities and its central network. Both times production stopped, both times plants were back within weeks, and both times the parent named the incident with no figure.
The pair rests on that response, not a cause: nothing on the record shows the same entry point, actor or weakness. The inference is BlastWave's analysis, not a disclosed fact: when disconnecting plants means stopping them, the outage is the dependency, and reconnecting restores it. The correction is ours: our earlier page gave the 2022 attack a vector, a root cause, a plant count and a loss. None had a source.
What is not known: Bridgestone has never said how the attacker got in, in either year, which systems were affected, or whether any production system was touched. In 2022 it called the attack untargeted ransomware; the LockBit leak site listed it. In 2025 it said “some,” later “several,” facilities and never said ransomware; “all factories in North America” is the Joliette mayor relaying executives. No count, no cost either time. Whether the two share a cause, or the architecture changed between them, is not on the record.
Recommendation
Take the path away, and keep it away Systems that gate production should not share a network path with business systems an intrusion travels through. After each disconnect, confirm the separation survived.
Prove a disconnected operating mode Keep a current list of what each plant needs from head office, cache it, and drill running for days with the corporate link cut. An unexercised fallback decays.
Make head office read one way Where corporate systems only need to see plant data, send it up a one-way path, so reconnecting after an incident does not restore a path back into the plant.
Sources: Bridgestone Americas statements, Feb-Mar 2022 (Tennessee Lookout, BleepingComputer) and 4 Sep 2025 (BleepingComputer); Bridgestone Corp. release, 18 Mar 2022; Q1 2022 slides; Q3 2025 results presentation, 12 Nov 2025. Full list with links.
Soft Spots: The repeat-victim reading is BlastWave's analysis; nothing shows a shared cause. The 2025 disconnection is inferred from “restored connections.” Most company words reach us through press; the ten-day figure is a spokeswoman's.
The full record
Every claim numbered to its source. Last updated .
In February 2022 Bridgestone Americas cut many plants off its own network to contain what it later called ransomware, and production stopped; in September 2025 its plants stopped again, and neither time did it name a vector or a cost. What is verified, what is only reported, and what is still unknown.
Summary
In February 2022, Nashville-based Bridgestone Americas disconnected many North and Latin American plants from its network to contain what it later called untargeted ransomware; plants were back about ten days later, by its account. In August and September 2025 a "limited cyber incident" stopped some plants again. Neither vector nor cost was disclosed, and nothing shows a shared cause.2,3,6,8,12
Timeline of the Bridgestone incidents
Every date is tied to a source. Press reporting appears only as evidence of what was said.
Bridgestone Americas detects an IT security incident and says it is "investigating a potential information security incident." It disconnects many of its manufacturing and retreading facilities in North and Latin America from its network.1,6,9
Company update: "it will take some additional partial production days to securely ramp up full production."6
All plants operated by Bridgestone Americas are back to normal operations, a company spokeswoman tells the Tennessee Lookout.12
Bridgestone Americas says the incident was ransomware, with "no evidence this was a targeted attack," and that information was removed "from a limited number of Bridgestone systems." The same day the LockBit leak site lists the company.1
The parent, Bridgestone Corporation, says "this incident was the result of an untargeted ransomware attack."2
Japanese trade paper Nikkan Jidosha Shimbun reports about a week of plant stoppage and access to "production-related systems"; the "production-related systems" wording is not in either Bridgestone release read.2,15
The parent's first quarter 2022 results slides mention "a cyber-attack incident at the U.S. subsidiary," with no figure.13
Tom Corridon, interim CISO at the time of the 2022 attack, is reported as saying security changes went through in the year after it; he does not say which.16,17
Production at the Joliette, Quebec plant is suspended, according to the local paper.4
Bridgestone Americas confirms a limited cyber incident that impacted some manufacturing facilities. WRDW reports two Aiken County plants affected.5
The company says it is investigating "a limited cyber incident impacting some of our manufacturing facilities," contained "in keeping with our established protocols." Cybernews carries the Joliette mayor's account, relayed from company executives, that all factories in North America were affected.8,18
A company spokesperson says plants are being returned "methodically" to full operation.19
The company says it has restored connections between its facilities and its central computer network, and that production was interrupted at several North American and Latin American manufacturing and retreading facilities, as Cybersecurity Dive reports.7
The parent's third quarter results date the incident to August and September 2025, "Settled down by mid-September," and name it as a negative impact on profits, with no amount.3
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
What did Bridgestone do on 27 February 2022?
Disconnected many plants in North and Latin America from its network "out of an abundance of caution"6
Verified (company statement)
Was the 2022 incident ransomware?
Yes, in the company's word, from 11 March 2022; "untargeted," per the parent1,2
Verified
Who was behind the 2022 incident?
Claimed by LockBit on its leak site; Bridgestone named no group1
Reported only
How long were the 2022 plants down?
About ten days, to 9 March 2022, per a company spokeswoman12
Verified (company's account)
Was the 2025 incident ransomware?
Never called that in any company statement read; the company's word is "limited cyber incident"8
Undisclosed
Did Bridgestone disconnect its plants in 2025?
Not in those words. It said it restored connections between its facilities and its central network7
Reported only (inferred)
Did all North American plants stop in 2025?
The Joliette mayor's account, relaying executives; the company said "some," later "several"7,8,18
Reported only
How did the attacker get in?
Not stated for either incident
Undisclosed
Were production systems reached?
No statement says so, or says they were found clean
Undisclosed
How many plants stopped?
No count either year: "many" (2022); "some," later "several" (2025)6,7,8
Undisclosed
Cost
Named in the parent's results both times, with no figure3,13
Undisclosed
Same cause both times?
Nothing on the record shows a shared vector, actor or weakness
Undisclosed
What happened at Bridgestone in 2022 and 2025?
Twice, three and a half years apart, Bridgestone Americas' plants stopped during a cyber incident, and both times the company had them back within weeks. On 27 February 2022 the Nashville-based tire maker detected an IT security incident and cut many of its plants off its own network. Its statement, through spokeswoman Emily Weaver:
"Out of an abundance of caution, we disconnected many of our manufacturing and retreading facilities in Latin America and North America from our network to contain and prevent any impact."
BleepingComputer carried the same sentence ending "any potential impact."1 On 3 March the company said it would "take some additional partial production days to securely ramp up full production," and a spokeswoman said all plants operated by Bridgestone Americas were back to normal operations by 9 March, about ten days after detection.6,12 On 11 March the company said the incident was ransomware; the parent called it "an untargeted ransomware attack" on 18 March and said that once Bridgestone Americas "was confident it contained the threat, the company began reconnecting systems and resumed operations."1,2
In late August 2025 plants stopped again. Local press reported Joliette, Quebec suspended from 31 August and two plants in Aiken County, South Carolina, affected the same week.4,5 On 4 September the company said:
"Bridgestone Americas continues to investigate a limited cyber incident impacting some of our manufacturing facilities. Our team responded quickly to contain the issue in keeping with our established protocols."
By 9 September a spokesperson said plants were being returned "methodically" to full operation, and on 17 September Cybersecurity Dive reported the company saying it had restored connections between its facilities and its central computer network.7,19 The parent dates the 2025 incident to August and September, settled by mid September.3
Were Bridgestone's production systems hacked?
No Bridgestone statement says any production system was reached, and none says they were examined and found clean. In 2022 the plants stopped because the company disconnected them; the parent's release says "The company immediately disconnected the affected systems from its network."2 That is the opposite of an attacker spreading from plant to plant: the stoppage was the company's containment.
The phrase "production-related systems" (生産関連システムなど) comes from a Japanese trade paper, Nikkan Jidosha Shimbun, on 19 March 2022. It is not in either Bridgestone release we read, and it is not a finding about plant control systems.2,15
For 2025, no statement names any affected system. The company said it did not believe "any customer data or interfaces were compromised."8 On the parent's results call, in the English interpretation, a Bridgestone executive the transcript does not name said back orders rose because production had to be suspended while sales continued.14 That describes a stoppage, not what was reached.
Was Bridgestone hit twice the same way?
Nothing on the record says so. No Bridgestone statement, parent release or results document names an entry point, an actor, a weakness or a root cause for either incident, so no shared cause can be shown, and none should be assumed.
What the record does show repeating is the response and the disclosure. In 2022 the company said it disconnected the plants. In 2025 it never used the word disconnect; it said it had restored connections between its facilities and its central network and had contained the incident under "established protocols," so the 2025 disconnection is a reading of those words, not a quotation.6,7,8 Both times production stopped, both times the plants were back within weeks, and both times the parent named the incident in its results materials with no figure.3,13
Whether anything about the network changed in between is not on the record. Tom Corridon, interim CISO at the time of the 2022 attack, was reported in May 2023 as saying that in the year since, Bridgestone had implemented security changes that would otherwise have taken years, and he spoke about disaster recovery plans and backups. He did not say which changes.16,17
Other incidents sit near these dates without being linked to them. Toyota suspended its Japanese plants the same week as the 2022 incident over an attack on a supplier, a separate incident.6 Jaguar Land Rover's incident began the same week as the 2025 one; that is adjacency, and no group or official body links the two.19
Did the 2025 incident stop every Bridgestone plant in North America?
That account is the mayor of Joliette, not the company. "All factories in North America" was Mayor Pierre-Luc Bellerose relaying company executives to a local outlet, MonJoliette, as carried into English by Cybernews on 4 September 2025; Dark Reading also reported that he gave it after contacting executives.18,20 The MonJoliette original could not be retrieved.
The company's own words were "some of our manufacturing facilities" on 4 September and, by 17 September, "several" North American and Latin American manufacturing and retreading facilities, in Cybersecurity Dive's report.7,8 In 2022 it said "many."6 It has never given a count for either incident, and it named no plant either time; every plant named on this page is named by local press.
How much did the Bridgestone incidents cost?
No cost has been disclosed for either incident. The parent's first quarter 2022 results slides list "a cyber-attack incident at the U.S. subsidiary" among risks that materialized, with no figure.13 Its third quarter 2025 results presentation names "the cyber incident, which occurred in August - September" as a negative impact on profits and lists it among the factors in a full-year revision alongside others, with no amount attributed.3
In the English interpretation of the November 2025 results call, the CEO is rendered as saying the North American incident would "also be a factor in the decline in earnings." That is an interpretation, not the company's written text, and it gives no figure.14 Back orders are not a cost figure, and the full-year revision is not the incident's cost.
What is still not known about Bridgestone
How the attacker got in, in either year.
Which systems were affected, and whether any production system was touched, in either year.
Which systems were encrypted in 2022, and which ransomware variant was used.
Who was behind the 2025 incident. No group had claimed it in any reporting found; leak sites were not checked for this entry.7,8
How many facilities stopped, in either year.
The cost of either incident.
When within August to September 2025 the intrusion began.3
Whether the two incidents share a cause, and whether the network architecture changed between them. Changes after 2022 are on the record; which changes is not.16
Whether the parent's securities reports or integrated reports for 2022 and 2025 describe either incident or the measures taken between them; they were outside this review.
Claims about Bridgestone the record does not support
Widely repeated claim
What the record says
"The attackers likely got in by spear phishing or a supply chain compromise."
No Bridgestone statement, parent release or results document names a vector for either incident. Published in our own Volume 1 entry with no source.2,21
"Weak credentials and a lack of segmentation were the root cause."
Never stated by Bridgestone or any official body. Published in our own Volume 1 entry with no source.21
"The attack spread laterally across the manufacturing enterprise."
No statement describes lateral movement. The plants stopped because the company disconnected them itself.2,6,21
"About 30 to 40 facilities were shut down."
The company said "many" in 2022 and gave no count.6,21
"The 2022 attack cost $100 million to $150 million."
Undisclosed. The parent named the incident in its Q1 2022 slides with no figure, and we cannot find where the range came from.13,21
"LockBit 2.0 ransomware hit Bridgestone."
The LockBit leak site listed the company; Bridgestone named no group and no variant.1,21
Japanese trade-press wording from 19 March 2022, not in either Bridgestone release read.2,15
"The 2025 cyberattack hit all of Bridgestone's factories in North America."
The Joliette mayor relaying executives, as carried by Cybernews. The company said "some," later "several."7,8,18
Including our own. The Volume 1 Hackopedia entry, "Bridgestone Tire Facilities (2022)," gave the 2022 attack a vector ("likely spear phishing or supply chain compromise"), a root cause ("weak credentials, lack of segmentation"), lateral spread across the manufacturing enterprise, LockBit 2.0 as the malware, about 30 to 40 facilities shut down and about $100 million to $150 million in losses. None of it traces to anything Bridgestone, its parent or any official body has published, and we cannot find where the dollar range came from. Those fields now read Undisclosed or carry the company's own words.21 We correct our own record first; it is what earns the right to correct anyone else's.
BlastWave analysis: the whistle is the outage
Analysis, not a disclosed fact
What follows is BlastWave's analysis, not a disclosed fact. Both times the plants stopped through containment, and nothing on the record says a curing press or a controller was reached in either year. When disconnecting plants means stopping them, the outage is the dependency rather than the intruder, and reconnecting restores the dependency. A response that ends there leaves the next containment to end the same way. Bridgestone has not published its network, and nothing shows the two incidents share a cause.
The decisions were right both times, and both were quick; this is a company that contained quickly and said so. The question is what containment costs when production depends on the network being isolated. Bridgestone's interim security chief from 2022 said in 2023 that changes followed the attack; whether they touched the path between plants and head office is not on the record.16
Podcast: “Same Pool, Same Whistle” (8:58). Joe Baxter and Cam Cullen on why what repeats on the record is the response, not the cause.
Video: Bridgestone Short (60 to 90 seconds).
Frequently asked questions
What happened at Bridgestone in 2022?
On 27 February 2022 Bridgestone Americas detected an IT security incident and, out of an abundance of caution, disconnected many of its manufacturing and retreading facilities in North and Latin America from its network, which stopped production. A company spokeswoman said all its plants were back to normal operations by 9 March 2022. On 11 March the company said the incident was ransomware, with no evidence it was a targeted attack.
What happened at Bridgestone in 2025?
Bridgestone Americas said on 4 September 2025 it was investigating "a limited cyber incident impacting some of our manufacturing facilities," contained under its established protocols. Local press reported plants in Aiken County, South Carolina, and Joliette, Quebec, stopped from the end of August. Cybersecurity Dive reported on 17 September that the company had restored connections between its facilities and its central network. The parent said in November the incident was settled by mid September.
Was the 2025 Bridgestone incident ransomware?
No Bridgestone statement read for this entry calls it ransomware. Every company statement on the 2025 incident read for this entry calls it a "limited cyber incident." Ransomware is the company's word for the 2022 incident only, announced on 11 March 2022 and repeated by the parent on 18 March 2022, which called it an untargeted ransomware attack. No group had claimed the 2025 incident in any reporting found.
Who attacked Bridgestone?
For 2022, the LockBit ransomware group listed Bridgestone Americas on its leak site on 11 March 2022, as BleepingComputer reported that day. That is a claim, not an attribution: Bridgestone named no group, and no government has attributed either incident. For 2025 the company has named no attacker and no group had claimed it in any reporting found. The Jaguar Land Rover incident the same week is not linked to Bridgestone by any group or official body.
Were Bridgestone's factory control systems hacked?
No Bridgestone statement says any production control system was reached, and none says they were examined and found clean. In 2022 the plants stopped because the company disconnected them from its network as a precaution. A Japanese trade paper reported access to "production-related systems" on 19 March 2022, but that wording is not in either Bridgestone release read. In 2025 no company statement named any affected system.
Did the 2025 attack shut down every Bridgestone plant in North America?
No company statement says so. The remark that the incident affected all factories in North America came from the mayor of Joliette, Quebec, Pierre-Luc Bellerose, relaying company executives to a local outlet, as carried in English by Cybernews on 4 September 2025. Bridgestone Americas said "some of our manufacturing facilities," and later, per Cybersecurity Dive on 17 September 2025, "several" in North and Latin America. It has never given a count.
How much did the Bridgestone cyberattacks cost?
Bridgestone has not disclosed a cost for either incident. The parent's first quarter 2022 results slides mention "a cyber-attack incident at the U.S. subsidiary" with no figure. Its third quarter 2025 results presentation of 12 November 2025 names the 2025 incident as a negative impact on profits, with no amount. A $100 million to $150 million loss once published in Hackopedia Volume 1 had no source and is corrected here.
Was Bridgestone hacked twice the same way?
Nothing on the record says so. No Bridgestone statement, parent release or results document names an entry point, actor or root cause for either incident, so no shared cause can be shown. What repeats, three and a half years apart, is the response: the company disconnected plants in 2022, and in 2025 said it restored connections between its facilities and its central network. Whether the architecture changed in between is not on the record.
Primary sources are Bridgestone Corporation's own releases and results materials. Bridgestone Americas gave its statements to reporters, so they are cited to the publications that carried them; other press is cited only as evidence of what was said.
PressIonut Ilascu, "Bridgestone Americas confirms ransomware attack, LockBit leaks data," BleepingComputer, 11 March 2022, reproducing Bridgestone Americas' statement of that date in full and reporting the LockBit leak-site listing the same day. bleepingcomputer.com
CompanyBridgestone Corporation, "IT security incident at Bridgestone Group Company in Americas," news release, 18 March 2022; Japanese release of the same date, 「当社米州グループ会社への不正アクセスについて」.
CompanyBridgestone Corporation, 2025年第3四半期累計 業績総括／通期見込 (third quarter 2025 results summary and full-year outlook), 12 November 2025, pp.6 and 13; English edition pp.5 ("Negative impact on profits due to the cyber incident, which occurred in August - September") and 13 ("Settled down by mid-September"). No amount attributed. PDF (Japanese)
PressJason Joly, "Suspension de la production à Bridgestone de Joliette," L'Action (Joliette), 3 September 2025 (production suspended since 31 August; about 1,400 workers; remarks of Mayor Pierre-Luc Bellerose). Cited as evidence of what was reported.
PressWRDW News 12, "Bridgestone Americas confirms cyber attack at some facilities," 1 September 2025. Cited as evidence of what the company said. wrdw.com
PressTennessee Lookout, 3 March 2022, carrying Bridgestone Americas' statement through spokeswoman Emily Weaver and the company's update of the same day ("it will take some additional partial production days to securely ramp up full production"); also reports the Warren County plant and, citing Reuters, Toyota's separate suspension of its Japanese plants. Cited as evidence of what the company said. tennesseelookout.com
PressDavid Jones, "Bridgestone Americas restores facilities' network connections following cyberattack," Cybersecurity Dive, 17 September 2025 (reported speech, not quotation). Cited as evidence of what the company said. cybersecuritydive.com
PressWRDW News 12 (Augusta), report of 27 February 2022 carrying Bridgestone Americas' holding statement ("Bridgestone Americas is currently investigating a potential information security incident") and the Aiken plant. Cited as evidence of what was said. wrdw.com
PressAiken Standard / Post and Courier, February 2022, reporting on the Graniteville plant. Cited as evidence of what was reported.
PressRIMQ, 2 March 2022, reporting on the Joliette, Quebec plant. Cited as evidence of what was reported.
PressAnita Wadhwani, "Bridgestone factories back online 10 days after cyberattack of unspecified origin," Tennessee Lookout, 10 March 2022 (company spokeswoman: all plants operated by Bridgestone Americas had resumed normal operations by Wednesday 9 March). Cited as evidence of what the company said. tennesseelookout.com
CompanyBridgestone Corporation, first quarter 2022 results presentation, 11 May 2022: English edition p.6, "a cyber-attack incident at the U.S. subsidiary"; Japanese edition p.5. No figure.
PressInvesting.com, English interpretation transcript of Bridgestone Corporation's third quarter 2025 results call, November 2025. An interpretation, not Bridgestone's written text.
PressNikkan Jidosha Shimbun, 19 March 2022 ("約1週間工場を停止した", about a week of plant stoppage; "生産関連システムなど", production-related systems and others). Japanese trade press, cited only as evidence of what was said.
PressJai Vijayan, "Bridgestone CISO: Lessons From Ransomware Attack Include Acting, Not Thinking," Dark Reading, 23 May 2023 (remarks of Tom Corridon, interim CISO at the time of the 2022 attack, at an OT cybersecurity summit). darkreading.com
PressJack Smith, "Learning from the Bridgestone Ransomware Attack," Automation.com, 23 May 2023 (Corridon on disaster recovery plans, immutable or air-gapped backups and tiering critical assets). automation.com
PressCybernews, 4 September 2025, carrying in English the Joliette mayor's account to MonJoliette ("the cyber incident is believed to have affected all factories in North America"). Cited as evidence of what was said; the MonJoliette original could not be retrieved.
PressDavid Jones, Cybersecurity Dive, 9 September 2025, quoting a Bridgestone Americas spokesperson. Cited as evidence of what the company said. cybersecuritydive.com
PressDark Reading, "Bridgestone Americas Confirms Cyberattack," September 2025, reporting that the Joliette mayor gave the all-plants account after contacting company executives. Cited as evidence of what was said. darkreading.com
CompanyBlastWave, Hackopedia Volume 1, "Bridgestone Tire Facilities (2022)," read 24 and 26 September 2026. Evidence of what BlastWave previously published, not a source for any fact on this page. hackopedia.blastwave.com
Cite this page
BlastWave. “Bridgestone Americas Cyber Incidents (2022 and 2025): What Is Verified.” Hackopedia, Volume 2, FILE 014. Last verified 28 September 2026. https://hackopedia.blastwave.com/manufacturing/bridgestone-2022/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 014 in Hackopedia Volume 2, in the Manufacturing edition.
28 Sep 2026
Hand-check at source: the Japanese trade-press report of 19 March 2022 and the Japanese edition of the parent's third quarter 2025 results presentation read in the original. The Joliette local report carrying the mayor's remark could not be retrieved, so the remark stays attributed to him through English-language coverage.
26 Sep 2026
Full validation: every company statement re-read in the publications that carried it, together with the parent's 18 March 2022 release and its 2022 and 2025 results materials. The 2025 footprint is given in the company's words: "some," later "several," North American and Latin American facilities.
25 Sep 2026
Volume 2 entry built from primary sources, covering the 2022 and 2025 incidents as one entry. Corrected Volume 1 errors: the vector, root cause, lateral spread, facility count, malware variant and loss figure, none of which had a source.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
