Volume 2Manufacturing edition2023Last verified 17 sources, 15 primaryVector and actor undisclosed
In April 2023 Ingersoll Rand detected an intrusion that disrupted several IT systems, isolated them, ran on workarounds and called it not material. Our Volume 1 page and video added an actor, a vector and an OT near miss.
Ingersoll Rand detected an intrusion on 27 April 2023 that disrupted several IT systems, brought in outside experts, isolated systems, ran workarounds, and had the incident in its quarterly report eight days later. Nothing on the record says a plant stopped or a control system was touched. The company handled it well. Our Volume 1 page and video added an actor, a VPN zero-day, a stolen terabyte, a loss range and an OT near miss. None of it is in any filing. The error is ours.
It stays in a book about OT because it is the version that went right, and the record does not say why. Whether production never depended on the business network, or people improvised around it, is undisclosed. This is BlastWave's analysis, not a disclosed fact: the gap between this entry and the ones where production stopped is likelier to be wiring than attacker skill.
What is not known: Ingersoll Rand has not said how the intruder got in, who it was, what tooling it used, which systems or sites were affected, how long the workarounds ran, or whether any line or shipment waited on them. Its only statement about data is that it is not aware of confidential customer information having been exfiltrated, which says nothing either way about other data. A Stormous leak-site listing exists, but one tracker dates it a month before the company's detection, and nothing links the two. No filing describes any effect on production or control systems.
Recommendation
Take the path away from production Separate the systems that gate production and shipping from the business network, so isolating IT costs the plant nothing it needs to run or ship.
Remove standing credential access Grant every remote or vendor path into production per session to a named, phishing-resistant identity, so a credential taken on the business side opens nothing.
Read production one way; rehearse paper Send production and shipping data out to ERP one way, and keep the offline path for orders, labels and dispatch current and rehearsed.
Sources: FY2023 Form 10-K, Item 1, 23 Feb 2024; Form 10-Q, 5 May 2023; Form 10-Q, 4 Aug 2023 (Segment Results); 8-K Ex. 99.1, 15 Feb 2024; EDGAR full-text search, CIK 0001699150, 25 Sep 2026. Full list with links.
Soft Spots: The wiring reading is BlastWave's analysis. The 5 May 2023 10-Q wording is pinned by EDGAR phrase search, not read whole. The Stormous listing date conflicts (27 Mar vs 11 Jul 2023) and is unresolved.
The full record
Every claim numbered to its source. Last updated .
An intrusion that disrupted several IT systems, was isolated and worked around, and was called not material. What is verified, what is only claimed, and what is still unknown.
Summary
On 27 April 2023, Ingersoll Rand, a compressor and pump maker, detected a cybersecurity incident that disrupted several of its information technology systems. It isolated systems, ran workarounds, and later said the incident had no material impact, adding back $2.3M of incident costs for 2023. It has never disclosed the vector, the actor, or any effect on production.1,3
Timeline of the Ingersoll Rand incident
Every date is tied to a source. Press reporting appears only as evidence of what was said.
One extortion-site tracker records a listing by the Stormous group for a company it calls "IRCO," a month before Ingersoll Rand's detection date. The record is flagged as a possible duplicate, and nobody has linked it to the April incident.5
Ingersoll Rand detects a cybersecurity incident that disrupts several of its information technology systems. It brings in external cybersecurity experts, isolates systems and implements workarounds.1
The incident appears in the 10-Q for the quarter ended 31 March 2023, eight days after detection. The company says it does not expect a material impact.2,8
Two other trackers date a Stormous listing of Ingersoll Rand to this day, both citing aggregation from the first tracker. The date conflict is unresolved.6,7
The second-quarter earnings release and 10-Q add back $2.2M labelled "Cybersecurity incident costs" in the adjusted earnings reconciliation.9,11
The full-year 2023 earnings release shows $2.3M of cybersecurity incident costs for the year, against revenue of $6,876.1M.3
The 2023 annual report says the incident did not have a material impact on results of operations or cash flows, and that the company is not aware of any confidential customer information having been exfiltrated.1
The 2024 annual report shows a further $0.5M on the cybersecurity incident costs line for 2024.10
Three other extortion groups post Ingersoll Rand or irco.com on their sites. These are separate, unverified claims and are not part of this entry. Ingersoll Rand files no incident 8-K through 25 September 2026.8,12
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
What did Ingersoll Rand disclose about the 2023 cyber incident?
An intrusion that disrupted several IT systems, which the company isolated, worked around and later called not material. Ingersoll Rand's record of the incident is one passage in its annual report and one line in its earnings reconciliation. The passage opens:
"On April 27, 2023, the Company detected a cybersecurity incident that disrupted several of our information technology systems."
The company says it launched a thorough investigation with the assistance of external cybersecurity experts and took immediate actions, including isolating systems and implementing workarounds, "to maintain business continuity and to minimize disruption to operations and customers."1 The same report says the incident did not have a material impact on results of operations or cash flows for 2023.1
The disclosure was early. The incident was in the 10-Q filed on 5 May 2023, eight days after detection, which already said the company did not expect a material impact.2,8 That was months before the SEC's incident disclosure item for Form 8-K took effect in December 2023. No incident 8-K exists: an EDGAR full-text search through 25 September 2026 finds every Ingersoll Rand 8-K that mentions a cybersecurity incident to be an earnings release.8 Compliance commentators quoted a later quarterly report's version of the disclosure in August and September 2023.13,14
Nothing else is on the record. The company has named no vector, no actor and no malware, and has said nothing about production or OT in either direction.1,8 The silence is the finding.
Did the Ingersoll Rand incident stop production or reach control systems?
The record does not say either way. The filings say information technology systems. No filing describes any effect on production, a plant or a control system, and none says there was none.1 On BlastWave's consequence ladder, this is an IT compromise with no physical operation halted on the record. That placement is by absence, and it is stated exactly that narrowly.
The company's description of its workarounds should be read whole. It says the actions were taken "to maintain business continuity and to minimize disruption to operations and customers."1 That is not a statement that production stopped, and it is not a statement that nothing was disrupted. How long the workarounds ran, and whether any line or shipment waited on them, is undisclosed.
Who was behind the Ingersoll Rand incident?
Undisclosed. Ingersoll Rand names no actor, and no government has attributed the incident.1 What exists is a claim. The Stormous extortion group listed a company it calls "IRCO" on its site, described in terms that match Ingersoll Rand. One tracker dates that listing 27 March 2023, a month before the company says it detected anything, and flags it as a possible duplicate.5 Two others date a Stormous listing 11 July 2023, while naming the first tracker's aggregation as their source, so the conflict may sit inside one tracker's history.6,7 One of them notes:
"No regulatory filing corroborates this claim yet."
Nothing ties the listing to the April incident. At most, the incident was claimed by Stormous, with the date problem attached. It may be a different event, a recycled claim or a tracker error; the record does not say which.
Nor is it established that this was ransomware. An EDGAR full-text search of Ingersoll Rand's filings from April 2023 to September 2026 finds "ransomware" only in its annual reports, and no Ingersoll Rand statement read for this entry uses it to describe this incident.8
Three further extortion groups posted Ingersoll Rand or irco.com in 2026: 0apt in February, ALP-001 in March and Clop in August, the last flagged by its tracker as a possible duplicate.12 Ingersoll Rand had filed no incident 8-K through 25 September 2026, and its first- and second-quarter 2026 reconciliations show no cybersecurity incident costs.8,15 These claims are separate, unverified and outside this entry.
Was data stolen in the Ingersoll Rand incident?
The company's only statement is that it is "not aware of any confidential customer information having been exfiltrated."1 That sentence is narrow by design. It covers customer information, and it covers the company's awareness. It is not a statement that no data left, and it says nothing either way about other data. No filing gives a data volume, and no filing says data was leaked.
How much did the incident cost Ingersoll Rand?
No total cost has been disclosed. The filed figure is an adjustment line: $2.2M in the second quarter of 2023 and $2.3M for the full year. It appears as "Cybersecurity incident costs" in the Segment Adjusted EBITDA reconciliation, added back when the company calculated adjusted earnings.3,9,11 It is a company-labelled adjustment, not a stated total, and the company said the incident had no material impact on 2023 results or cash flows.1 For scale, full-year 2023 revenue was $6,876.1M.3
EDGAR exact-phrase search places the wording "non-recoverable costs associated with a cybersecurity event" in Ingersoll Rand filings beginning with the 10-Q of 4 August 2023.8,9 It says "a cybersecurity event," not the April 2023 incident.
The line did not end in 2023. The 2024 annual report shows $0.5M for 2024.10 Later releases show credits of $0.2M in the first quarter of 2025 and $1.1M in the second ($1.3M for the half), and nothing in the first two quarters of 2026.15 The company does not say whether the 2024 and 2025 amounts belong to the April 2023 incident.
What is still not known about Ingersoll Rand
How the intruder got in. No filing or statement gives a vector.1,8
Who it was. A Stormous listing exists, but nothing links it to the April incident, and which date it actually went up (27 March or 11 July 2023) is unresolved.5,6,7
What tooling was used, and whether anything was encrypted.8
Which systems, sites or regions were affected.
How long the workarounds ran, and whether any production line or shipment waited on them.
Whether any data other than confidential customer information left. The company's statement covers only customer information and its own awareness.1
Whether the systems that gate production depended on the business network at all.
Whether the 2024 amount and the 2025 credits on the cybersecurity incident costs line belong to the April 2023 incident.10,15
Whether any state data breach notification was filed. None was found in searches as of late September 2026, which is not a finding that none exists.
Claims about Ingersoll Rand the record does not support
Widely repeated claim
What the record says
"Ingersoll Rand was hit by Stormous ransomware."
Ingersoll Rand names no actor and no malware. A Stormous listing is a claim, dated a month before detection by one tracker, and never linked to the incident.1,5,8
"The attackers got in through a VPN zero-day."
No filing or statement gives a vector. The VPN zero-day traces only to BlastWave's Volume 1 video and page.1,4,16
"It started with spear phishing or a supply chain compromise."
Undisclosed. The phrase traces only to our Volume 1 page.4
"About a terabyte of data was stolen, and data was publicly leaked."
No filing gives a volume or says data was leaked. The company is "not aware of any confidential customer information having been exfiltrated."1
"The attack was stopped before it could spread to the OT control network."
The filings say information technology systems and say nothing about OT in either direction. The company never claimed that save.1
"Losses of $5M to $10M."
The only filed figure is a $2.3M adjustment line for 2023, not a stated total; the incident was not material.1,3
"Weak credentials and a lack of segmentation caused it."
Root cause undisclosed. The company describes its response, not a cause.1
"The attack happened in March 2023."
Ingersoll Rand detected the incident on 27 April 2023. The March date matches only a tracker's listing date.1,5
Including our own. Our Hackopedia Volume 1 page called this "Stormus Ransomware" in March 2023, with a VPN zero-day, "Likely Spear Phishing or Supply Chain compromise," about a terabyte of data exfiltrated, "~$5M-10M in losses, ~3% of data leaked publicly" and "Prevention Failure: Weak Credentials, Lack of Segmentation."4 Our Volume 1 video named a group as the attacker, misspelled its name, and said the attack was stopped before it could spread to the OT control network.16 Our April 2026 blog added a working credential and a flat network.17 None of it is on the record, and all of it is withdrawn here. We correct our own record first; it is what earns the right to correct anyone else's.
Where did the stolen terabyte, the VPN zero-day and the OT near miss come from?
From us. None of it is in any Ingersoll Rand filing. Our Hackopedia Volume 1 video said the Stormous group was believed to have used zero-day vulnerabilities in a VPN, that data was exfiltrated and publicly leaked, that about a terabyte was stolen, and that the attack was stopped before it could spread to the OT control network.16 Our Volume 1 page headed the entry "Stormus Ransomware," dated it March 2023, and added "~$5M-10M in losses, ~3% of data leaked publicly," "Likely Spear Phishing or Supply Chain compromise" and "Prevention Failure: Weak Credentials, Lack of Segmentation."4 Our April 2026 blog went further and described the attackers finding a working credential and walking into a vast, flat network.17
As best we can reconstruct it, our version came from two separate records sewn into one story: an extortion-site listing that one tracker dates to March 2023, and the company's own April detection date.1,5 Neither record was wrong; the join was. We then filled every blank between them with the most plausible thing. This reconstruction is ours, based on our page's March date and our video's April date, and is not a documented history.
The two halves of our error pointed in opposite directions. The video gave Ingersoll Rand credit for a save it never claimed, and the page blamed it for weak credentials it never admitted.4,16 The record says neither.
BlastWave analysis: the version that went right
Analysis, not a disclosed fact
Ingersoll Rand detected, brought in outside experts, isolated, kept working, and put the incident in a quarterly report eight days later. The company handled it well, and this entry says so. It stays in a book about OT because it is the version that went right, and the record does not say why. Whether production kept going because the systems that gate it never depended on the business network, or because people improvised around them, is undisclosed.1,2
This is BlastWave's analysis, not a disclosed fact: the gap between this entry and the ones where production stopped is likelier to be wiring than attacker skill. The same kind of IT intrusion has sent other manufacturers to manual processing or halted production. The variable the filings never describe is how production depends on the business network.
Podcast: “The Paper Score Sheets” (8:56). Joe Baxter and Cam Cullen on why the incident that went right still belongs in a book about OT, and on what our first book got wrong about it.
Video: Ingersoll Rand Short (60 to 90 seconds).
Frequently asked questions
What happened in the Ingersoll Rand cyberattack in 2023?
Ingersoll Rand said in its 2023 annual report that on 27 April 2023 it detected a cybersecurity incident that disrupted several of its information technology systems. It brought in external cybersecurity experts, isolated systems and implemented workarounds to maintain business continuity. It first disclosed the incident in a 10-Q filed on 5 May 2023 and later said it had no material impact on 2023 results or cash flows.
Was the Ingersoll Rand incident ransomware?
No Ingersoll Rand statement read for this entry says so. A full-text search of its SEC filings from April 2023 to September 2026 finds the word ransomware only in its annual reports. The company has named no malware and has not said whether anything was encrypted. Descriptions of the incident as ransomware, including in BlastWave's own first Hackopedia, are not supported by the company's record.
Who hacked Ingersoll Rand?
The attacker is undisclosed. Ingersoll Rand names no actor and no government has attributed the incident. The Stormous extortion group listed a company it calls IRCO on its leak site, but one tracker dates that listing 27 March 2023, a month before the company's 27 April detection, while others date it 11 July 2023. Nobody has linked the listing to the April incident.
Did the Ingersoll Rand incident affect production or OT systems?
The record does not say either way. Ingersoll Rand's filings describe several information technology systems disrupted, isolated and worked around to minimize disruption to operations and customers. No filing describes any effect on production, a plant or a control system, and none says there was none. Claims that the attack was stopped before it reached the OT network are not in any company filing.
How much did the cyberattack cost Ingersoll Rand?
No total cost has been disclosed. Ingersoll Rand added back $2.2 million labelled cybersecurity incident costs in the second quarter of 2023 and $2.3 million for the full year when calculating adjusted earnings, then $0.5 million for 2024. That is an adjustment line, not a stated total. The company said in February 2024 that the incident had no material impact on 2023 results or cash flows.
Was data stolen from Ingersoll Rand?
Ingersoll Rand's only statement is that it is not aware of any confidential customer information having been exfiltrated, in its annual report filed 23 February 2024. That statement covers customer information and the company's awareness; it is not a statement that no data left. No company filing gives a data volume or says data was leaked. The one terabyte figure traces to BlastWave's own first Hackopedia, not the record.
Was Ingersoll Rand hacked again in 2026?
Three extortion groups, 0apt, ALP-001 and Clop, posted Ingersoll Rand or irco.com on their sites between February and August 2026, according to threat-intelligence trackers. These are unverified claims. Ingersoll Rand had filed no incident 8-K through 25 September 2026, and its first and second quarter 2026 earnings reconciliations show no cybersecurity incident costs. They are separate from the April 2023 incident.
Primary sources are Ingersoll Rand's own SEC filings and EDGAR full-text searches of them. Extortion-site trackers are cited only as evidence of what was claimed, press only as evidence of what was said, and BlastWave's Volume 1 material only as evidence of what we published.
Company filingIngersoll Rand Inc., Form 10-K for fiscal year 2023, filed 23 February 2024 (accession 0001628280-24-006642), Item 1, Recent Developments, "Cybersecurity Incident Status." sec.gov
Company filingIngersoll Rand Inc., Form 10-Q for the quarter ended 31 March 2023, filed 5 May 2023 (accession 0001628280-23-016124). The first disclosure of the incident. sec.gov
Company filingIngersoll Rand Inc., Form 8-K, Exhibit 99.1, fourth quarter and full year 2023 earnings release, filed 15 February 2024 (accession 0001628280-24-005078): "Cybersecurity incident costs" of 2.3 for the twelve months of 2023; revenue $6,876.1 million. sec.gov
CompanyBlastWave, Hackopedia Volume 1 page on Ingersoll Rand, as served 25 September 2026. Cited as evidence of what we published; corrected by this entry. hackopedia.blastwave.com
ResearcherRansomware.live, victim record "IRCO," group Stormous, discovered 27 March 2023 17:17 UTC, flagged as a potential duplicate. Evidence of a claim, not of an event. ransomware.live
ResearcherGalaxyWarden, "Ingersoll Rand Listed by stormous Ransomware Group" (listing dated 11 July 2023; no record count, data types or sample published). Evidence of a claim, not of an event.
ResearcherDisclosureLens, incident record inc_a8de93ea836c4ad3 (claim posted 11 July 2023). Evidence of a claim, not of an event.
RegulatorUS Securities and Exchange Commission, EDGAR full-text search of Ingersoll Rand Inc. filings (CIK 0001699150), 2023 to September 2026, run 25 September 2026: "April 27, 2023" (four filings), "cybersecurity incident" (every 8-K hit an earnings release), "ransomware" (generic risk-factor text only).
Company filingIngersoll Rand Inc., Form 10-Q for the quarter ended 30 June 2023, filed 4 August 2023 (accession 0001628280-23-027540), Segment Results note: "Cybersecurity incident costs" of 2.2 for the three and six months ended 30 June 2023. sec.gov
Company filingIngersoll Rand Inc., Form 10-K for fiscal year 2024, filed 19 February 2025 (accession 0001628280-25-006391), Segment Results details: "Cybersecurity incident costs" of 0.5 (2024), 2.3 (2023), 0.0 (2022). sec.gov
Company filingIngersoll Rand Inc., Form 8-K, Exhibit 99.1, second quarter 2023 earnings release, filed 2 August 2023 (accession 0001628280-23-026779): "Cybersecurity incident costs" of 2.2 for the second quarter and first half of 2023. sec.gov
ResearcherDeXpose, posts on the 0apt claim (4 February 2026) and the ALP-001 claim (21 March 2026); ransomware.live, victim record "IRCO.COM," group Clop, discovered 12 August 2026, flagged as a possible duplicate. Listed only so these later claims are not merged into this entry.
PressRadical Compliance, "A Look at Actual Cyber Disclosures," 20 August 2023. Cited as evidence of how the quarterly disclosure was read at the time. radicalcompliance.com
PressNorman Marks, "More useful information about cyber risk," 14 September 2023. Cited as evidence of how the quarterly disclosure was read at the time.
Company filingIngersoll Rand Inc., Form 8-K, Exhibit 99.1 earnings releases: first quarter 2025, filed 1 May 2025 ((0.2) for Q1 2025, 0.6 for Q1 2024); first quarter 2026, filed 28 April 2026 (nil for Q1 2026); second quarter 2026, filed 30 July 2026 (nil for 2026; (1.1) for Q2 2025 and (1.3) for the first half of 2025).
CompanyBlastWave, Hackopedia Volume 1 video on Ingersoll Rand. Cited as evidence of what we published; withdrawn.
CompanyBlastWave blog, "The 'Crunchy Exterior' Strikes Again," April 2026. Cited as evidence of what we published; corrected by this entry.
Cite this page
BlastWave. “Ingersoll Rand Cybersecurity Incident (2023): What Is Verified.” Hackopedia, Volume 2, FILE 015. Last verified 28 September 2026. https://hackopedia.blastwave.com/manufacturing/ingersoll-rand-2023/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 015 in Hackopedia Volume 2, in the Manufacturing edition.
28 Sep 2026
Final review: the entry was checked field by field against the full record and against the related Clorox, Nucor and Johnson Controls entries.
26 Sep 2026
Full validation of every claim against Ingersoll Rand's filings. The production statement was narrowed to "no physical operation halted on the record," and the disclosure timing to "months before the SEC's incident disclosure item took effect."
25 Sep 2026
Second validation: every description of what our Volume 1 page and video said was re-checked against our Volume 1 material and corrected to their exact words; the first disclosure's wording was confirmed by exact-phrase search of EDGAR; the 2025 cost-line credits and a third 2026 extortion-site claim were identified and kept separate from this entry.
24 Sep 2026
Volume 2 entry built from Ingersoll Rand's SEC filings. Corrected Volume 1 errors: an actor, a VPN zero-day, a terabyte stolen, data leaked, a $5M to $10M loss range, a ransomware label, a March attack date and an OT near miss.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
