A German government report says attackers phished into a steelworks' office network, worked into production, and a blast furnace could not be shut down in a controlled manner. It named no plant, no date, no attacker.
Almost all that is known here is one paragraph in a German federal report. Credible, it is also the only primary source, with no name, date, attacker or technical detail. It claims physical damage and corroborates none of it, so this entry places it as a claimed case. The rest grew on it: a wrecked furnace in headlines, an attribution to Russian hackers with no attributing body named, a company and dollar figures from a 2022 laboratory report, and in our own first volume a wrong year, a state sponsor and an unsourced cost.
What it supports is narrow and useful. The office could reach production, and once control components failed, a controlled shutdown was no longer available. BlastWave's reading, not a disclosed fact: the question is not whether a plant catches the phish, but whether the business network can reach production, and whether a way down exists that avoids the systems that failed.
What is not known: The BSI never named the steelworks or dated the attack, its discovery or its duration. It named no attacker or malware, gave no cost, and did not say how the attackers crossed from the office network into production, which components failed, whether anyone was hurt, or whether the damage was intended. The victim has never spoken publicly. A 2022 US national laboratory analysis names Thyssenkrupp on secondary sources; that furnace was down that year for a planned modernisation, and no Thyssenkrupp statement either way was found.
Recommendation
Take the path away from the office Nothing that reads email or browses the web should have a route into the production networks. Remove the walk, and a successful phish ends in the office.
Remove standing access to controllers No persistent credentials, sessions or remote tools from business systems into controllers. Logic changes happen in a scheduled window, under a named identity.
Make process data read one way Production reporting gets furnace data through a unidirectional path, so systems that only need the numbers can never write to the systems that run the process.
Sources: BSI, Die Lage der IT-Sicherheit in Deutschland 2014, §3.3.1, p. 31; BSI, The State of IT Security in Germany 2014, §3.3.1, p. 31; SANS ICS Defense Use Case, 30 Dec 2014; INL/RPT-22-70679, 31 Dec 2022. Full list with links.
Soft Spots: The Thyssenkrupp name rests on one secondary analysis, never confirmed. The English is BlastWave's from the German; the BSI's own English edition says “uncontrolled shutdown.” The architecture reading is BlastWave's analysis.
The full record
Every claim numbered to its source. Last updated .
A phish into a steelworks' office network, a walk into production, and a blast furnace that could not be shut down in a controlled manner, all from one unnamed, undated paragraph. What is verified, what is only reported, and what is still unknown.
Summary
In December 2014, Germany's Federal Office for Information Security (BSI) reported that attackers phished into an unnamed German steelworks' office network and worked into its production networks. Failing control components left a blast furnace unable to be shut down in a controlled manner, causing massive damage to the plant. The BSI named no company, date, attacker or malware.1
Timeline of the public record
Every date is tied to a source. Press reporting appears only as evidence of what was said.
The BSI's download page for its annual report, Die Lage der IT-Sicherheit in Deutschland 2014, carries this date. Section 3.3.1, on printed page 31, describes a targeted attack on a steelworks in Germany. The attack itself is undated.1
The report is presented in Berlin by Federal Interior Minister Thomas de Maizière and BSI President Michael Hange, according to reporting at the time.3
The Register publishes the headline "Hackers pop German steel mill, wreck furnace."5
SANS publishes an ICS Defense Use Case by Robert M. Lee, Michael J. Assante and Tim Conway. It rates the report's credibility "4, probably true" and its technical information "2."4
Bloomberg lists "a German steel plant that suffered severe damage" among attacks "now being attributed to Russian hackers," without naming who attributed them.6
The Idaho National Laboratory dates its precursor analysis report INL/RPT-22-70679, which names Thyssenkrupp on secondary sources and builds a timeline around one of its furnaces.7
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
Who published the account?
Germany's Federal Office for Information Security (BSI), in its 2014 situation report, section 3.3.11
Verified
How did the attackers get in?
Spear phishing and sophisticated social engineering, into the office network. No technical detail published1
Verified (BSI statement only)
Did they reach production?
They "worked their way, step by step, into the production networks" (BlastWave translation)1
Verified (BSI statement only)
What happened to the furnace?
It "could not be shut down in a controlled manner and was in an undefined state"1
What did the BSI report say about the German steel mill?
About 125 words, in one section of one government report, and that is almost the whole primary record. Section 3.3.1 of the BSI's Die Lage der IT-Sicherheit in Deutschland 2014, headed "APT-Angriff auf Industrieanlagen in Deutschland" (APT attack on industrial plants in Germany), sits on printed page 31 under the heading for incidents in industry.1 It is organized under the report's own labels:
Sachverhalt (incident): a targeted attack on a steelworks in Germany.1
Methode (method): by means of spear phishing and sophisticated social engineering, attackers gained initial access to the steelworks' office network, then worked their way, step by step, into the production networks.1
Schadenswirkung (effect): failures of individual control components or of entire plants accumulated; a blast furnace could not be shut down in a controlled manner and was in an undefined state; the consequence was massive damage to the plant.1
Zielgruppen (target groups): operators of industrial plants.1
Technische Fähigkeiten (technical capabilities): the attackers' capabilities are rated very advanced; the compromise extended to many internal systems up to and including industrial components; their know-how extended to detailed knowledge of the industrial controls and production processes in use.1
"Die Ausfälle führten dazu, dass ein Hochofen nicht geregelt heruntergefahren werden konnte und sich in einem undefinierten Zustand befand. Die Folge waren massive Beschädigungen der Anlage."
The English renderings above are BlastWave's translation, kept close to the German. Every line was checked against the BSI's own German and English PDFs. In the report as read for this entry, the words for steelworks and blast furnace appear only on page 31; the BSI did not elaborate elsewhere in it.1,2 Later BSI reports were not read in full.
Was the blast furnace destroyed?
The report does not say so. The German states an inability and an unknown state, then damage of unstated extent: the furnace "nicht geregelt heruntergefahren werden konnte" (could not be shut down in a controlled manner) and was "in einem undefinierten Zustand" (in an undefined state). It does not say the furnace exploded, burned, broke out or was destroyed.1
"Massive Beschädigungen der Anlage" means massive damage to the plant. Anlage can mean the furnace installation or the wider facility; the extent is not given.1 The BSI's own English edition renders the passage as an event:
"The breakdowns led to the uncontrolled shutdown of a blast furnace, leaving it in an undefined state and resulting in massive damage."
So "uncontrolled shutdown" is the BSI's own English, not a press paraphrase. This entry follows the German original, which states an inability, and labels its translation as BlastWave's. Anyone quoting the BSI in English should quote its English edition. The "wrecked furnace" came from headlines, such as The Register's on 22 December 2014.2,5 SANS, working from a translation, recorded the furnace type as "uncertain"; both BSI editions say blast furnace.1,2,4
Which steelworks was it?
The BSI never said, and no confirmation exists in any record we found. The report names no company and no location.1 NATO CCDCOE's Cyber Law Toolkit records that the German government never disclosed the name or location of the steel mill.10
The only document found that names a company is a 2022 Idaho National Laboratory precursor analysis, Cyber Attack on Thyssenkrupp Blast Furnace 2014, produced by the CyOTE program and, by its own statement, funded by the Department of Energy's Office of Cybersecurity, Energy Security and Emergency Response. The report itself says the BSI's "exact dates and details of the attack were not revealed," and that "multiple sources identified the victim." It then builds a timeline and dollar figures around a furnace in Duisburg. Its reference list was not retrievable, so those sources and figures could not be traced to a primary record.7
That furnace was down in 2014 for a planned modernization. Handelsblatt reported the planned work on 24 July 2014, at about 200 million euros. Thyssenkrupp's own announcement of 20 October 2014, on relighting the furnace after "gut drei Monate" (a good three months) of work following 21 years of operation, mentions no incident.8,9 BlastWave's reading, not a finding: the naming therefore rests on nothing that mentions a cyber incident. That does not show the attack happened somewhere else. No Thyssenkrupp statement confirming or denying was found as of late September 2026.
Not the same incident: in December 2016, Thyssenkrupp disclosed a separate intrusion into its steel production and plant design divisions aimed at technical know-how, and said production systems were not affected. That is a different year and a different kind of harm, with no established link to the BSI's account.12
Who was behind the German steel mill attack, and was it sabotage?
No one has been named, and intent is unknown. The BSI calls it an APT attack and rates the attackers' capabilities very advanced. Those are a category and a rating; neither names an actor or a state.1 No government attribution was found as of late September 2026.
In October 2015, a Bloomberg report listed "a German steel plant that suffered severe damage" among attacks "now being attributed to Russian hackers." The sentence does not say who was doing the attributing.6 No tool, sample or malware family linked to this incident has been published in any record we found.
The BSI is silent on intent. The SANS case study of 30 December 2014 wrote that the description "leads the authors to believe the process damage was intentional," and in the same paper that "very few theories can be ruled out." That is a labeled belief from careful analysts, not a finding, and it travels with its hedge.4A German news headline of 18 December 2014 said hackers "sabotieren" (sabotage) a German steelworks.11
How did the attackers reach the blast furnace?
The route is stated; the mechanism is not. The BSI says the attackers got into the office network by spear phishing and social engineering, then worked step by step into the production networks.1 It does not say how the boundary was crossed, which control components failed, or whether the failures were commanded, induced or collateral. It does not say the attackers sent commands to the furnace.1
Later reference sources added detail the BSI text does not carry. NATO CCDCOE's toolkit entry, for example, adds PLCs and Windows-based systems, neither of which appears in section 3.3.1.10 SANS rated the technical information available as "2," with detail only on how the intrusion entered the corporate network.4
On the consequence ladder this series uses, the record reaches for the top rung, OT command execution with corroborated physical effect, on one government paragraph that states neither command execution nor corroboration. This entry places it as a claimed top-rung case, not a corroborated one. The paragraph is credible: a federal authority published it, and nothing found in nearly twelve years contradicts it. It is also the only primary source.
What is still not known about German Steel Mill
The name and location of the steelworks. The BSI never gave them.1
When the attack happened, when it was discovered and how long it lasted.1
Who the attackers were. No government has attributed the incident, in any record we found.
What malware or tools were used.
How the attackers crossed from the office network into the production networks.1
Which control components failed, and whether the failures were commanded, induced or collateral.1
The extent of the damage and its cost, and whether anyone was hurt.1
The sources behind the 2022 laboratory analysis's naming, timeline and dollar figures; its reference list was not retrievable.7
Whether the victim has ever commented. No statement either way was found as of late September 2026.
Whether the BSI ever elaborated. Nothing was found in the material read; later BSI reports were not read in full.
Claims about German Steel Mill the record does not support
Widely repeated claim
What the record says
"Hackers wrecked the furnace."
The BSI says a blast furnace could not be shut down in a controlled manner and was in an undefined state, with massive damage to the plant of unstated extent. Nothing says destroyed.1,5
"Hacker sabotieren deutsches Stahlwerk" (hackers sabotage German steelworks)
The BSI is silent on intent. SANS's view that the damage was intentional is a labeled belief, published with "very few theories can be ruled out."1,4,11
"Russian hackers attacked a German steel mill."
A 2015 Bloomberg report said "now being attributed to Russian hackers" and named no attributing body. No government attribution was found.6
"Cyber Attack on Thyssenkrupp Blast Furnace 2014"
One 2022 laboratory analysis, on secondary sources, never confirmed. The furnace it names was down for a publicly announced, planned modernization; that does not show the attack happened somewhere else.7,8,9
"The attackers sent commands to the furnace and reprogrammed PLCs."
The BSI states failures of control components, not commands. PLC detail was added later by reference sources.1,10
"The attack cost $100 to 330 million."
The BSI gives no cost, and no source for the range was found.1,13
Including our own. Our Volume 1 Hackopedia page, "German Steel Mill Attack (2015)," dated the incident 2015, called it state-sponsored, stated physical sabotage as the goal, described a destroyed blast furnace, gave several days to weeks of downtime and a cost of $100 to 330 million, and described weak credentials and an engineering workstation sending unauthorized control commands.13 The BSI report supports none of it: the attack is undated and 2014 is only the year of disclosure, and the report names no attacker and says nothing about intent, duration, cost or commands.1 All are corrected here. We correct our own record first; it is what earns the right to correct anyone else's.
BlastWave analysis: the architecture, not the phish
Analysis, not a disclosed fact
What the paragraph supports is narrow and still useful. The office network could reach production, and once control components began to fail, a controlled shutdown of the plant's hottest process was no longer available.1 BlastWave's reading, not a disclosed fact: the question this case puts to any plant is not whether it would catch the phish, but whether anything on the business network can reach production at all, and whether there is a way down that does not run through the systems that failed.
Nothing in the record describes what the plant's staff did or failed to do, and a successful phish is not a competence finding. The argument is architecture: a path from the office network into production, and a controlled shutdown that depended on components that failed.
Podcast: “The Kiln Comes Down” (9:11). Joe Baxter and Cam Cullen on why the lesson is not catching the phish, but keeping the office away from production and a way down that does not run through the systems that failed.
Video: German Steel Mill Short (60 to 90 seconds).
Frequently asked questions
What happened in the German steel mill cyberattack?
In its annual IT security situation report, released in December 2014, Germany's Federal Office for Information Security (BSI) said attackers used spear phishing and social engineering to get into a steelworks' office network, then worked step by step into its production networks. Failures of control components accumulated, a blast furnace could not be shut down in a controlled manner, and the plant suffered massive damage. The BSI named no company, date, attacker or malware.
Was the blast furnace destroyed in the German steel mill attack?
The BSI report does not say so. Its German text says the furnace could not be shut down in a controlled manner and was in an undefined state, and that the consequence was massive damage to the plant, with no extent given. The BSI's own English edition calls it an uncontrolled shutdown. Headlines in December 2014 that said the furnace was wrecked went beyond the report.
Which company owned the German steel mill that was attacked?
The BSI never named the company or the location. A 2022 Idaho National Laboratory analysis names Thyssenkrupp, saying multiple sources identified the victim, while noting the BSI revealed no exact dates or details. That naming has never been confirmed. The furnace it points to was down in 2014 for a planned, publicly announced modernization, which does not show the attack was elsewhere. No Thyssenkrupp statement either way was found as of late September 2026.
Who was behind the German steel mill attack?
No one has been named. The BSI called it an APT attack and rated the attackers very advanced, with detailed knowledge of the industrial controls and processes in use, but named no actor or state. A Bloomberg report in October 2015 listed the plant among attacks being attributed to Russian hackers without saying who attributed them. No government attribution was found as of late September 2026.
When did the German steel mill attack happen?
No primary record says. The BSI report that disclosed the incident gives no date for the attack, its discovery or its duration. The report's download page is dated 15 December 2014, and it was presented in Berlin on 17 December 2014, according to reporting at the time. 2014 is therefore the year of disclosure, not a known attack year. Dates published elsewhere do not trace to a primary record.
Was the German steel mill attack sabotage?
The BSI report says nothing about intent. A SANS case study published on 30 December 2014 said the description led its authors to believe the process damage was intentional, and in the same paper said very few theories could be ruled out. That is a labeled belief, not a finding. Whether the damage was the goal or a side effect of the intrusion has never been established on the record.
How did hackers get into the German steel mill?
According to the BSI's December 2014 report, attackers gained initial access to the steelworks' office network by spear phishing and sophisticated social engineering, then worked their way step by step into the production networks. The report gives no lure, payload or date, and does not say how the attackers crossed from the office network into production or whether they sent commands to the furnace.
The primary record for this incident is one section of one government report, the BSI's 2014 situation report in its German and English editions. Every other source is evidence of what was said about that section, never of what happened.
GovernmentBundesamt für Sicherheit in der Informationstechnik (BSI), Die Lage der IT-Sicherheit in Deutschland 2014, section 3.3.1 "APT-Angriff auf Industrieanlagen in Deutschland," printed page 31. Download page dated 15 December 2014. PDF · Download page (dated 15.12.2014)
GovernmentBSI, The State of IT Security in Germany 2014 (English edition), section 3.3.1 "APT attack on industrial installations in Germany," p. 31. PDF
PressESET WeLiveSecurity (German edition), report on the presentation of the BSI's 2014 situation report, 19 December 2014. Cited for the Berlin presentation. welivesecurity.com
ResearcherRobert M. Lee, Michael J. Assante, Tim Conway, "German Steel Mill Cyber Attack," SANS ICS Defense Use Case, 30 December 2014 (copy hosted by Kaspersky; the sans.org original is no longer available). PDF
PressThe Register, "Hackers pop German steel mill, wreck furnace," 22 December 2014. Cited for the headline as published. theregister.com
PressBloomberg, "Cyberspace Becomes Second Front in Russia's Clash With NATO," 14 October 2015, as republished by The Japan Times, 15 October 2015. Cited as evidence of what was said. japantimes.co.jp
FederalIdaho National Laboratory, CyOTE, Precursor Analysis Report: Cyber Attack on Thyssenkrupp Blast Furnace 2014, INL/RPT-22-70679, dated 31 December 2022. Cited as evidence of what was said; its naming is not confirmation. osti.gov · CyOTE copy (PDF)
PressHandelsblatt, "Investitionen bei ThyssenKrupp: Pause für Europas größten Hochofen," 24 July 2014. handelsblatt.com
CompanyThyssenkrupp Steel Europe press release, "Größter Hochofen Europas angeblasen: Schwelgern 2 erschmilzt wieder Roheisen," 20 October 2014, read in a verbatim republication of the same date (the company's own URL is no longer available). republication
ResearcherNATO CCDCOE, Cyber Law Toolkit, "Steel mill in Germany (2014)." Cited as evidence of later additions to the record and for its statement that the German government never disclosed the mill's name or location. ccdcoe.org
Presst-online, "BSI-Sicherheitsbericht: Hacker sabotieren deutsches Stahlwerk," 18 December 2014. Cited for the headline. t-online.de
PressHelp Net Security, "Hackers stole technical trade secrets from German steelmaker," 9 December 2016. Cited for Thyssenkrupp's disclosure of a separate 2016 intrusion. helpnetsecurity.com
CompanyBlastWave, Hackopedia Volume 1 entry "German Steel Mill Attack (2015)" (hackopedia.blastwave.com). Cited as evidence of what we said.
Cite this page
BlastWave. “German Steel Mill Cyberattack (Disclosed 2014): What Is Verified.” Hackopedia, Volume 2, FILE 008. Last verified 28 September 2026. https://hackopedia.blastwave.com/manufacturing/german-steel-mill-2014/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 008 in Hackopedia Volume 2, in the Manufacturing edition.
28 Sep 2026
Hand-check and final review: the Berlin presentation of the BSI report was checked against reporting at the time, since the BSI's own press release could not be retrieved, and the entry was checked against the related entries that cite it.
26 Sep 2026
Full validation pass. The incident is now placed as a claimed case of physical damage rather than a corroborated one, since the BSI does not say commands were sent; the statement that nothing contradicts the report was scoped to what was found; the laboratory analysis's funding source was corrected to the one it states.
25 Sep 2026
Second verification: every line of section 3.3.1 checked against the BSI's own German and English PDFs, page 31. Corrected: "uncontrolled shutdown" is the BSI's own English, not a press paraphrase, and the laboratory analysis's statement that the BSI gave no dates is quoted from its body, not its abstract.
24 Sep 2026
Volume 2 entry built from primary sources. Corrected Volume 1 errors: the 2015 date, the state sponsor, sabotage stated as the goal, the destroyed furnace, and downtime and cost figures with no source.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
