Incident Types: The types of cybersecurity incidents that have occurred include Vulnerability and Breach.

Total Financial Loss: The total financial loss from these incidents is estimated to be $0.

Detection and Response: The company detects and responds to cybersecurity incidents through an third party assistance with nozomi networks (vulnerability disclosure and research), and containment measures with patch development (scheduled for late january 2024), containment measures with limited disclosure of vulnerability details to allow time for patching, and remediation measures with software update for affected devices, remediation measures with customer advisories via rss feed, and communication strategy with public statement by bosch spokesperson, communication strategy with customer notifications via advisories and rss feed, communication strategy with delayed full disclosure of technical details..

Common Attack Types: The most common types of attacks the company has faced is Vulnerability.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Management web application of the nutrunner device.

Average Financial Loss: The average financial loss per incident is $0.00.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Name, Date Of Birth, Address, Social Security Or Tax Id Number, Government-Issued Id Number, Medical Information, Health Insurance Information and .

Third-Party Assistance: The company involves third-party assistance in incident response through Nozomi Networks (vulnerability disclosure and research), .

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Software update for affected devices, Customer advisories via RSS feed, .

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by patch development (scheduled for late january 2024), limited disclosure of vulnerability details to allow time for patching and .

Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through Potential (if vulnerabilities lead to safety incidents or defective products).

Key Lessons Learned: The key lessons learned from past incidents are Increasing interconnectivity in production lines amplifies cyber risks in OT environments.,Unauthenticated access to industrial devices can lead to severe physical and operational consequences.,Safety-critical devices require robust security measures beyond traditional IT protections.,Delayed disclosure of vulnerability details can provide time for mitigation but may limit collaborative defense.

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Recorded Future News (via Nozomi Networks research), and Source: Nozomi Networks Vulnerability Advisory, and Source: Bosch Rexroth Customer Advisories (RSS feed), and Source: U.S. Department of Health and Human Services.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public Statement By Bosch Spokesperson, Customer Notifications Via Advisories And Rss Feed and Delayed Full Disclosure Of Technical Details.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Bosch Rexroth Public Statement Acknowledging Vulnerabilities And Patch Timeline., Nozomi Networks Coordinated Disclosure With Limited Technical Details., Notifications Via Bosch Rexroth Rss Feed., Urgent Recommendation To Install Patches Once Available. and .

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Nozomi Networks (Vulnerability Disclosure And Research), .

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Software Patch To Address Authentication And Message Injection Vulnerabilities., Enhanced Monitoring For Unauthorized Configuration Changes., Review Of Custom Protocol Implementations (E.G., Volkswagen, Bmw) For Security Flaws., .

Last Ransom Demanded: The amount of the last ransom demanded was Potential (scenario described but not yet observed).

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-10-31.

Most Recent Incident Resolved: The most recent incident resolved was on 2024-01-31.

Highest Financial Loss: The highest financial loss from an incident was Potential large-scale losses due to production line stoppages, product recalls, or lawsuits.

Most Significant Data Compromised: The most significant data compromised in an incident was Sensitive personally identifiable information.

Most Significant System Affected: The most significant system affected in an incident were Bosch Rexroth NXA015S-36V-B nutrunner/pneumatic torque wrenchConnected production lines (e.g., automotive manufacturing)Management web application for device configuration.

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was nozomi networks (vulnerability disclosure and research), .

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident was Patch development (scheduled for late January 2024)Limited disclosure of vulnerability details to allow time for patching.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach was Sensitive personally identifiable information.

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 550.0.

Highest Ransom Demanded: The highest ransom demanded in a ransomware incident was Potential (scenario described but not yet observed).

Most Significant Legal Action: The most significant legal action taken for a regulatory violation was Potential (if vulnerabilities lead to safety incidents or defective products).

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Delayed disclosure of vulnerability details can provide time for mitigation but may limit collaborative defense.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Implement multi-factor authentication for management interfaces on OT devices., Isolate or segment industrial devices from broader network access where possible., Apply Bosch Rexroth patches immediately upon release (late January 2024)., Develop incident response plans specific to OT environments and safety-critical devices., Conduct regular security assessments for interconnected production systems. and Monitor for unauthorized changes to device configurations or torque settings..

Most Recent Source: The most recent source of information about an incident are Bosch Rexroth Customer Advisories (RSS feed), U.S. Department of Health and Human Services, Nozomi Networks Vulnerability Advisory and Recorded Future News (via Nozomi Networks research).

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing (patch in development, no known exploits to date).

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Bosch Rexroth public statement acknowledging vulnerabilities and patch timeline., Nozomi Networks coordinated disclosure with limited technical details., .

Most Recent Customer Advisory: The most recent customer advisory issued was an Notifications via Bosch Rexroth RSS feed.Urgent recommendation to install patches once available.

Most Recent Entry Point: The most recent entry point used by an initial access broker was an Management web application of the nutrunner device.