Bajaj contains ransomware breach after systems hit

Bajaj Auto has disclosed a ransomware attack that affected its systems and those of its wholly owned technology subsidiary, Bajaj Auto Technology Limited, adding another listed manufacturer to the widening roster of companies forced to make cyber-risk disclosures to investors.

The Pune-based two- and three-wheeler maker said the incident took place on 23 June at around 8am IST. Technical teams, senior management and external cybersecurity specialists responded after the breach was detected, triggering precautionary protocols to contain the attack and limit operational impact. The company said the response measures had been successful based on information available at the time of its stock exchange filing.

The disclosure was made under corporate governance norms and the incident has been reported to the Indian Computer Emergency Response Team, the national cyber incident response agency, in line with the Information Technology Act, 2000. Bajaj Auto did not specify the ransomware strain, identify the attackers, disclose whether any ransom demand had been made, or state whether data had been stolen.

The absence of detail on possible data exposure leaves investors and customers waiting for further clarity. Ransomware attacks often begin with unauthorised access to internal systems before attackers encrypt files, exfiltrate data, or threaten public disclosure. Companies sometimes describe containment as successful while forensic teams continue to assess whether information was copied before systems were isolated.

Bajaj Auto’s shares fell after the disclosure, dropping around 2 per cent in morning trade on 24 June and becoming one of the weaker performers on the Nifty 50. The timing drew attention because 24 June was also the record date for the company’s ₹5,632 crore share buyback. The board had approved a tender offer to repurchase up to 46.94 lakh equity shares at ₹12,000 apiece, representing 1.68 per cent of paid-up equity capital.

The market reaction came despite Bajaj Auto’s strong March-quarter performance. Standalone net profit for the quarter rose 34 per cent year-on-year to ₹2,746.13 crore, while revenue from operations increased 31.8 per cent to ₹16,005.7 crore. Earnings before interest, tax, depreciation and amortisation rose 35.6 per cent to ₹3,322.7 crore, with the operating margin expanding to 20.8 per cent.

The cyberattack places fresh focus on technology resilience inside manufacturing groups, particularly those with large dealer networks, vendor ecosystems, export operations and connected enterprise systems. Bajaj Auto operates in a sector where digital platforms now manage production planning, supplier coordination, sales channels, warranty systems and finance-linked customer services. Even limited disruption can affect logistics, invoicing, procurement and customer-facing applications if core systems are isolated during containment.

The company’s technology subsidiary is central to that concern. Bajaj Auto Technology Limited supports digital and engineering capabilities within the group, making its inclusion in the disclosure significant. A compromise involving both parent and subsidiary systems suggests that investigators will need to examine whether the breach moved laterally across shared infrastructure or through linked applications.

The incident also comes amid a sharp escalation in cyber threats against industrial and technology-linked businesses. Industrial organisations have become high-value targets because downtime can create pressure to settle quickly. Threat groups have shifted from simple encryption attacks to double-extortion tactics, where stolen data is used to force payment even when a company can restore systems from backups.

Manufacturers face a distinct challenge because they must protect both information technology and operational technology. Legacy equipment, third-party remote access, production software and supplier portals often create entry points that are harder to monitor than standard corporate networks. Cybersecurity teams therefore increasingly treat incident response, backup segregation and supplier access controls as board-level issues rather than routine IT functions.

The Bajaj disclosure follows other cyber incidents involving major business groups and suppliers, underscoring how attackers are targeting companies embedded in global supply chains. The risk is no longer confined to banks, software firms or consumer platforms. Auto, electronics, logistics, energy and industrial equipment companies have become frequent targets because their systems connect commercial data, intellectual property and time-sensitive operations.