Incident: Cyberattack on Honda's Industrial Control Systems Halts Global Production

Published Date: 2020-06-12

Postmortem Analysis
Timeline 1. The software failure incident at Honda happened in June 2020. [101219]
System 1. Internal computer networks 2. Control systems for industrial facilities like factories and power plants 3. American Honda Finance Corporation system 4. System that automatically orders parts for dealers 5. Remote access system for employees
Responsible Organization 1. Cyber attackers using software designed to attack control systems for industrial facilities like factories and power plants were responsible for causing the software failure incident at Honda [101219].
Impacted Organization 1. American Honda Finance Corporation [101219] 2. Honda's factories in North America, Brazil, India, and Turkey [101219]
Software Causes 1. The software cause of the failure incident was a computer virus that hit Honda, disrupting its internal computer networks and affecting its factories globally [101219].
Non-software Causes 1. The attack on Honda was likely facilitated by a possible breach related to remote working policies put in place after the beginning of the coronavirus pandemic, which may have opened an opportunity for hackers to introduce the virus [101219].
Impacts 1. The software failure incident caused Honda to shut down factories across the globe, disrupting production at most North American plants, as well as factories in Brazil, India, and Turkey [101219]. 2. Employees were cut off from email and internal servers, impacting communication and workflow within the company [101219]. 3. The American Honda Finance Corporation was affected, leading to the inability to answer calls, fund contracts, provide payoff quotes, or service customer accounts [101219]. 4. A system that automatically orders parts for dealers was suspended, and dealers were unable to submit new warranty claims [101219]. 5. The incident led to a temporary pause in production at Honda's factories to ensure safety, with the last factory reopening on Thursday morning [101219].
Preventions 1. Implementing robust cybersecurity measures such as regular security audits, intrusion detection systems, and network segmentation to prevent unauthorized access to critical systems [101219]. 2. Providing comprehensive cybersecurity training to employees to raise awareness about potential threats like phishing attacks and malware infiltration [101219]. 3. Ensuring strict access controls and monitoring remote access to internal networks to prevent unauthorized entry points for hackers [101219].
Fixes 1. Enhancing cybersecurity measures to prevent future attacks like the one experienced by Honda, such as implementing stronger network security protocols and regularly updating cybersecurity software [101219].
References 1. Cybersecurity analysts [Article 101219] 2. Masahiro Shimomura, head of the Japan Network Security Association [Article 101219] 3. Honda spokesperson, Misako Saka [Article 101219] 4. Cybersecurity firm Malwarebytes [Article 101219] 5. Information posted to an online repository [Article 101219]

Software Taxonomy of Faults

Category Option Rationale
Recurring multiple_organization (a) The software failure incident at Honda is not explicitly mentioned to have happened again within the same organization in the provided article [101219]. (b) The article mentions a similar incident involving a computer virus hitting Japanese automaker Honda, disrupting its internal computer networks. This incident is not unique to Honda as previous assaults on Japanese corporations have been aimed at disrupting communications or stealing data [101219].
Phase (Design/Operation) design, operation (a) The software failure incident at Honda was likely due to contributing factors introduced during the design phase. The attack was carried out by software designed to attack the control systems for industrial facilities like factories and power plants, indicating a sophisticated level of planning and design by the attackers [101219]. (b) The software failure incident at Honda could also be attributed to contributing factors introduced during the operation phase. Speculation has centered around a possible breach related to remote working policies put in place after the beginning of the coronavirus pandemic, suggesting that the operation or misuse of systems, such as remote access to internal networks, may have facilitated the introduction of the virus [101219].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident at Honda was likely due to a computer virus that penetrated the internal server and spread within the company's networks, disrupting operations and forcing the shutdown of factories globally [101219]. The attack was identified when employees could not open their email or files, indicating that the virus had infiltrated the internal systems of Honda [101219]. (b) outside_system: Speculation has arisen that the software failure incident at Honda may have been facilitated by a possible breach related to remote working policies implemented during the coronavirus pandemic. It is suggested that a system providing remote access to internal networks could have created an opportunity for hackers to introduce the virus from outside the system [101219].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident at Honda was caused by a computer virus, which disrupted the internal computer networks and control systems for industrial facilities like factories and power plants [101219]. This incident was likely a result of non-human actions, as the virus was designed to attack these systems without direct human involvement. (b) Speculation has centered around a possible breach related to remote working policies put in place after the beginning of the coronavirus pandemic as a potential human action that may have contributed to the software failure incident at Honda [101219].
Dimension (Hardware/Software) software (a) The software failure incident at Honda was not attributed to hardware issues but rather to a computer virus that disrupted the internal computer networks, affecting the control systems for industrial facilities like factories and power plants [101219]. (b) The software failure incident at Honda was caused by a computer virus that targeted the company's internal networks, disrupting operations and forcing the shutdown of factories across the globe. The attack was carried out by software designed to attack control systems for industrial facilities, indicating a failure originating in software [101219].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident at Honda was malicious in nature. The incident involved a computer virus attack on Honda's internal computer networks, disrupting operations across global factories and leaving employees unable to access email or internal servers. Cybersecurity analysts indicated that the attack was carried out by software designed to target control systems for industrial facilities, with the potential to bring factories to a halt or disrupt power grids. The attack was identified as a ransomware meant to disrupt industrial systems, indicating a malicious intent to disrupt operations [101219]. (b) The incident was not non-malicious as it involved a deliberate attack on Honda's systems with the objective of disrupting operations and potentially causing significant harm.
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions (a) The software failure incident at Honda was likely due to poor decisions related to cybersecurity practices. The attack was carried out by software designed to attack control systems for industrial facilities, a capability previously only known to be used by state agents. The attack disrupted Honda's internal computer networks, leading to the shutdown of factories across the globe and leaving employees cut off from email or internal servers. Speculation has centered around a possible breach related to remote working policies put in place after the beginning of the coronavirus pandemic, suggesting that decisions related to remote access may have opened an opportunity for hackers to introduce the virus [101219]. (b) The software failure incident at Honda could also be attributed to accidental decisions or unintended consequences. The attack was identified when employees could not open their email or files, indicating that the virus had penetrated an internal server and then spread. The company ordered employees not to turn on corporate computers and temporarily shut factories to assess the extent of the damage. The cybersecurity firm Malwarebytes suggested that the tool used in the attack was a relatively new variety of ransomware meant to disrupt industrial systems, in addition to encrypting files, indicating an unintended consequence of the attack [101219].
Capability (Incompetence/Accidental) accidental (a) The software failure incident at Honda was not attributed to development incompetence. The attack was carried out by software designed to attack control systems for industrial facilities, indicating a sophisticated and intentional cyberattack rather than a failure due to incompetence [101219]. (b) The software failure incident at Honda was accidental in the sense that the virus entered the internal networks, possibly through a breach related to remote working policies implemented during the coronavirus pandemic. The speculation is that a system providing remote access to internal networks may have inadvertently provided an opportunity for hackers to introduce the virus [101219].
Duration temporary (a) The software failure incident at Honda was temporary. Production at most North American plants was canceled on Monday, resumed at some on Tuesday, and all were back running by Thursday. The last factory, located in Ohio, was reopened on Thursday morning [101219]. The incident was temporary as the company stated that it had "almost entirely recovered" by Friday, and production at the factories was temporarily paused to ensure safety before being resumed [101219].
Behaviour omission, other (a) crash: The software failure incident at Honda resulted in the shutdown of factories across the globe, leaving employees cut off from email or internal servers. Production was canceled at most North American plants, and work was halted at factories in Brazil, India, and Turkey. The incident caused a disruption in business operations and forced the company to temporarily pause production to assess the extent of the damage [101219]. (b) omission: The virus attack on Honda's internal networks led to disruptions in various operations. For example, the American Honda Finance Corporation was unable to answer calls, fund contracts, provide payoff quotes, or service customer accounts. Additionally, a system that automatically orders parts for dealers was suspended, and dealers were unable to submit new warranty claims [101219]. (c) timing: The incident at Honda involved a timing aspect as well. The attack was identified on a Monday morning in Japan when employees could not open their email or files. The company ordered employees not to turn on corporate computers and temporarily shut factories to assess the extent of the damage. Production at the factories was temporarily paused to ensure safety, and the last factory, located in Ohio, was reopened on Thursday morning [101219]. (d) value: The software failure incident at Honda did not result in a loss of personally identifiable information, according to the company. However, various operations were disrupted, such as the American Honda Finance Corporation being unable to provide certain services to customers [101219]. (e) byzantine: The behavior of the software failure incident at Honda did not exhibit characteristics of a byzantine failure as described in the articles. (f) other: The software failure incident at Honda involved the use of ransomware meant to disrupt industrial systems, in addition to encrypting files. The attack was identified as a variation of a group of programs called Snake, which was specifically aimed at Honda's internal networks. Speculation suggested that the virus may have entered the networks through a possible breach related to remote working policies implemented during the coronavirus pandemic [101219].

IoT System Layer

Layer Option Rationale
Perception sensor, processing_unit, network_communication, embedded_software (a) sensor: The software failure incident at Honda was related to a computer virus that disrupted its internal computer networks, leading to the shutdown of factories across the globe. The attack was carried out by software designed to attack the control systems for industrial facilities like factories and power plants, indicating a failure at the sensor level where the control systems were compromised [101219]. (b) actuator: The incident at Honda was primarily focused on the disruption caused by the computer virus to the internal computer networks and control systems of the factories. While the specific mention of actuator errors is not provided in the article, the attack targeted the production line and process controls, which could involve actuator systems in the factories [101219]. (c) processing_unit: The software failure incident at Honda involved a computer virus that penetrated the internal server and spread, leading to the disruption of operations and the shutdown of factories. This indicates a failure at the processing unit level where the internal servers were compromised, affecting the overall processing of data and operations [101219]. (d) network_communication: The attack on Honda's internal networks and control systems by the computer virus disrupted communication channels within the company. Employees were cut off from email and internal servers, and the virus spread through the internal server, affecting network communication within the organization [101219]. (e) embedded_software: The software failure incident at Honda was caused by a computer virus that targeted the internal networks and control systems of the company. The attack was carried out using a variation of ransomware meant to disrupt industrial systems, indicating a failure at the embedded software level where the systems controlling the industrial processes were compromised [101219].
Communication link_level The software failure incident at Honda, caused by a computer virus, was related to the communication layer of the cyber physical system that failed. The attack targeted the control systems for industrial facilities like factories and power plants, indicating a link_level failure [101219]. Additionally, the virus disrupted internal computer networks, leading to a shutdown of factories across the globe and leaving employees cut off from email or internal servers, which aligns with issues at the communication layer of the cyber physical system.
Application FALSE The software failure incident at Honda, where a computer virus disrupted its internal computer networks, causing factory shutdowns and email/server access issues, was not explicitly mentioned to be related to the application layer of the cyber physical system. The incident was primarily attributed to a cyberattack using ransomware designed to disrupt industrial systems [101219]. Therefore, it is unknown whether the failure was specifically related to the application layer as defined in the question.

Other Details

Category Option Rationale
Consequence property, non-human (d) property: People's material goods, money, or data was impacted due to the software failure. The software failure incident at Honda resulted in disruptions to the company's operations, including the inability to answer calls, fund contracts, provide payoff quotes, service customer accounts, and submit new warranty claims. Additionally, a system that automatically orders parts for dealers was suspended, affecting the flow of goods and services [101219].
Domain manufacturing, utilities, finance (a) The failed system at Honda was intended to support the manufacturing industry. The software failure incident disrupted Honda's internal computer networks, leading to the shutdown of factories across the globe [101219]. The attack targeted the control systems for industrial facilities like factories, indicating a focus on disrupting manufacturing operations [101219]. (g) The failed system also impacted the utilities industry. The attack on Honda disrupted its operations globally, including factories in various countries like Brazil, India, and Turkey. This disruption affected the production line and potentially could have led to the shutdown of power grids [101219]. (h) Additionally, the incident affected the finance industry. The American Honda Finance Corporation was unable to answer calls, fund contracts, provide payoff quotes, or service customer accounts due to the virus attack. This disruption in financial services highlights the impact on the finance sector [101219].

Sources

Back to List