Demant ransomware attack

On 3 September 2019, Demant — the Danish multinational behind the Oticon hearing-aid brand and one of the world's largest hearing-healthcare companies — detected a "critical incident" on its servers and began an emergency shutdown of IT systems across sites and business units worldwide. The disruption that followed produced an estimated loss of up to $95 million, making it one of the most expensive single ransomware-class incidents ever publicly quantified.

What happened

Demant did not publish full technical details, but the response pattern — shutting down systems across multiple sites and business units around the globe — is the signature of a fast-spreading ransomware infection. Danish media reported the incident as ransomware, though Demant itself never formally confirmed the malware family or named an attacker.

The shutdown knocked out the systems that manufacture, distribute, and process orders for hearing aids and diagnostic equipment. With its ERP and production platforms offline, Demant could not take or fulfill orders normally for an extended period, hitting its core revenue stream at scale.

The financial impact

When Demant quantified the damage in November 2019, the numbers were striking:

• An estimated total impact of DKK 550–650 million, roughly $80–95 million.
• Around half of the loss stemmed from lost sales and the inability to process orders — not from the technical cleanup.
• The direct cost of recovering IT systems was comparatively small, around $7.3 million.
• Demant held a cyber-insurance policy that absorbed part of the loss; the company indicated the bill would have been roughly $14.6 million higher without it.

Why it matters

Demant became a textbook illustration that the dominant cost of ransomware is business interruption, not ransom or remediation. The company appears not to have paid a ransom, yet still absorbed up to $95 million in damage — overwhelmingly from lost sales while production stood still. The case also showcased the value of cyber insurance in cushioning catastrophic operational losses, and it underlined the fragility of globally integrated manufacturing, where a single intrusion can simultaneously freeze plants and order systems on multiple continents. For a healthcare manufacturer, the disruption also delayed delivery of medical devices to patients who depend on them.