Business operations impacted, cyberattack to hurt revenue: Sun Pharma

A March 2 ransomware attack that hit Mumbai-headquartered pharmaceuticals firm, Sun Pharma, has impacted business operations at the company, and will have an impact on its revenue across specific verticals, the company said in a regulatory filing with the National Stock Exchange on Monday.

While not specifying exact details, the regulatory filing said that the breach affected “certain file systems and the theft of certain company data and personal data.” It remains unclear as to what the exact nature of the breached data was, or if any ransom was paid.

However, Sun Pharma’s disclosure stated that the regular business operations of the company “have been affected”, and “some” business verticals expect to take a revenue hit in the company’s FY23 financials.

The filing further added that a ransomware gang has claimed responsibility for the incident, and that it has taken “steps to contain and remediate the impact of the IT security incident, including employing containment and eradication protocols to mitigate the threat and additional measures to ensure the integrity of its systems infrastructure and data.”

Sun Pharma is employing “cyber security experts and enhanced security measures to address and mitigate the impact of the incident,” the statement further added.

The ransomware incident is the third notable cyber security incident for a major homegrown pharmaceutical firm, after Hyderabad-headquartered Dr Reddy’s Laboratories and Mumbai-headquartered Lupin disclosed ransomware attacks on their IT infrastructure within a space of two weeks — between October 22 and November 5, 2020.

The incident also highlights growing concerns globally regarding the impact of cyber attacks on the healthcare sector, which handles critical personal data — and is often a top target for cyber attackers globally. On March 7, an agenda note by World Economic Forum cited US cyber security firm RiskLens’ 2023 annual report to highlight that the healthcare sector is the second most-targeted, after public and government infrastructure, in terms of both its risk of being targeted, and the amount of losses that it incurs annually.

Companies have also regularly reported increasing losses as a result of cyber attacks. In May 2020, US-headquartered IT services firm Cognizant, which has a significant operation hub in India, disclosed in a US regulatory filing that a ransomware attack on its IT infrastructure reduced its revenue by $50-70 million.