Picanol Group ransomware production halt (Belgium, 2020)

On 13 January 2020, the Belgian weaving-machine manufacturer Picanol Group was hit by a ransomware attack that paralysed its three production plants — in Ieper (Belgium), Romania, and China — for over a week. With its entire production process controlled by computers, Picanol had no manual fallback and was forced to suspend operations almost completely.

What happened

Picanol designs and builds high-end industrial weaving machines and employs roughly 2,300 staff worldwide, with 1,600 in Ieper alone. The attack encrypted the IT systems that orchestrate Picanol's manufacturing operations across all three plants. Because Picanol's production process is end-to-end computer-managed, the company had no practical way to manufacture during the outage.

Picanol confirmed the cyberattack publicly on 15 January 2020. Trading in Picanol's shares on Euronext Brussels was suspended during the disruption. The company set expectations clearly with the market: there would be no production that week, and the restoration would proceed step-by-step.

Production restarted progressively on 20 January 2020, approximately a week after the initial encryption. Share trading resumed at the same time.

Impact

• All three production plants (Belgium, Romania, China) halted for ~a week.
• Approximately 2,300 employees affected by the disruption.
• Euronext trading in Picanol shares suspended during the outage.
• Production restarted step-by-step from 20 January 2020.

Why it matters

Picanol is one of the cleanest early cases of a ransomware-driven production halt at a mid-cap manufacturer with a fully computerised production line. The market response — automatic suspension of share trading — set an important precedent for how European exchanges treat cyber-driven operational disruptions at listed manufacturers, and the staged restart became a model for similar incidents at Norsk Hydro, Asahi, and Continental in subsequent years.