Continental AG LockBit ransomware (Germany, 2022)

In August 2022, the German automotive-parts giant Continental AG — one of the largest tier-1 suppliers in the global auto industry — was breached by LockBit ransomware operators. The initial response declared the intrusion contained. The November leak proved otherwise: LockBit listed approximately 40 terabytes of stolen Continental data on its dark-web leak site, with a public price tag of $50 million.

What happened

Attackers infiltrated parts of Continental's IT systems in early August 2022. Continental detected the activity and stated that it had "averted" the intrusion. Then, in September, LockBit operators contacted Continental, claimed responsibility for the August event, demanded a ransom, and threatened to publish the data.

On 4 November 2022, LockBit's public countdown clock for the Continental data expired. Continental publicly confirmed on 7 November that the criminals had stolen "a significant amount" of data — reversing the August containment claim. Days later, LockBit listed approximately 40 TB of Continental data on its leak site, offering it "for sale or destruction" for $50 million.

The scale alone — 40 terabytes — placed this among the largest single-victim data thefts publicly disclosed by a ransomware operation at the time. Germany's BKA (Federal Criminal Police Office) and the FBI joined the investigation.

Impact

• Significant amount of internal Continental data — claimed at ~40 TB — stolen.
• $50 million demand placed on the leak site.
• Containment narrative collapsed three months after initial detection.
• Triggered renewed attention to LockBit's industrial-target operations in Germany.

Why it matters

The Continental case is a cautionary example of the difference between detecting attackers and removing them: early containment claims do not necessarily reflect what attackers have already exfiltrated, and ransomware operations often delay extortion specifically to maximise leverage. The 40 TB scale of the theft also previewed what LockBit would later inflict on Boeing and ICBC.