Shares in British engineering company dive as it announces cost of cyberattack

Morgan Advanced Materials, which produces ceramic and carbon parts used in semiconductor manufacturing, told investors on Tuesday that last month’s cyberattack could cost it up to £12 million — prompting its shares to dive.

The British company — one of the 350 most valuable businesses listed on the London Stock Exchange — announced in January that it was “managing a cyber security incident after detecting unauthorized activity on its network.”

The nature of the incident has still not been confirmed, however the description of the impact of the incident in an update for investors published through the Regulatory News Service is consistent with ransomware.

Morgan Advanced Materials said that all of its manufacturing sites are operational “although some continue to use manual transaction processes as work continues to restore their systems.”

It added that “a small number of systems have proven irrecoverable” which it is responding to by bringing in a cloud-based enterprise resource planning solution — basically replacing all of its on-premise IT with a software-as-a-service product.

Shares in the company, which engineers industrial components alongside materials used in electric vehicles, solar panels and the semiconductor manufacturing process, were trading down more than 5% on Tuesday morning following the update.

“Exceptional costs associated with the incident could amount to approximately £8m to £12m, comprising specialist professional fees, as well as costs associated with recovering a number of systems across the Morgan Group,” the company announced.

Morgan, which was founded in 1856, has become one of the United Kingdom’s leading manufacturers of specialist materials with nearly 7,800 employees globally and annual revenues of just over £950 million ($1.15 billion).

The company warned that the incident meant a number of sites “experienced a delay in restarting production and shipping due to the cyber security incident,” which — alongside the exceptional costs of responding to the incident — was expected to hit its margins.

“Whilst demand has remained strong during January, we are experiencing production inefficiency during the recovery period which, based on current estimates, could lead to adjusted operating profit for FY2023 being approximately 10% to 15% below our previous expectations.”

A similar business, Vesuvius Plc, said Monday that it was also responding to a "cyber incident."